From 505fcd9c3fda1f67b7b368a68a41b2df11e0920d Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 05:17:02 -0500
Subject: [PATCH 01/68] update(blog)!: Add iOS vs Android Security: What Each
 Can Learn from the Other

---
 .../images/ios-vs-android/binarly-graphic.png | Bin 0 -> 80961 bytes
 blog/posts/ios-vs-android.md                  |  74 ++++++++++++++++++
 2 files changed, 74 insertions(+)
 create mode 100644 blog/assets/images/ios-vs-android/binarly-graphic.png
 create mode 100644 blog/posts/ios-vs-android.md

diff --git a/blog/assets/images/ios-vs-android/binarly-graphic.png b/blog/assets/images/ios-vs-android/binarly-graphic.png
new file mode 100644
index 0000000000000000000000000000000000000000..1cee1a019918330fc78fd8fc8d486f16f746c30a
GIT binary patch
literal 80961
zcmb5VWmuGL*EUQ_Nq2{|gmkAM-Koe>(lOFG;2=nMcXu};4ARowjdXX%J9u69b3Z=Y
z_viaN+nncdthM&FuRMcPm1WRTNl;;6V9@1crPN_y;ALT8U^|dsK!2gY6x@M<`2r&+
zC86mC*asmc;%QB}{1CWbF24iqv5hZwAejARktbV=l#oDSeizLsM~n87G1FKa4@-)}
zSZd0-4ZkK(0PWpCsIRf4FD$OZ<K5EX?sw<nVn>y$^VBPMfLUQvkzHDm=d$2c`sob<
z9GFVULha30KgldrMm)20ua^YK2yhY@zGBV(|NQjr|MySUDdZ34<3E2|kQlh3rcGCh
zv9jz+_XqzNL+?tnaJTPirY%RG4z%v#`8_v^w2ihT_I%I)<tc|Q6&5mr0P^E;IePu;
zM0ti6??%b!Fznb4#jO=E^QTD>Efi)AEX;3!+X3BoBkA3u*}`;xz3Lq0_64Z(PKmJ;
zvowNT$#2KJ91^%@QYj97u>;oqYMNaAl}cV#+iGoYAyV0Ekx1Tzhd6IdNibUAt^7IS
zEduDPsH8#Gu$vgF|4sMp<Cs*U_vUU0qv#8?XH6lsQ7$DJmiRIY^1k`T_F6DFoy}Hp
zzTZd2Q~w3GQQ$V|Irc3o=o{oM<*7G5>Ym_6UQlIy(gC5`|5D-jAcob7K+R{YMg6f<
zQP#T}<Q#-Rh-60A(MZ6y!cwcGk$!G7H?~>ItOs^ik0BU(^>wQ24xzOD-3+N3QjE+5
zlDLsWhpUEmqFe~m6HkjyeFjD0R4kdq>yX#m@oSgiJR3KXA4$uxr-QA#>vAxg=>xZg
z&Z%#4Kz(=b8A}yn6X@GN8r!!1r5Co#bCq0oY0!3Bwa*AU+t;z-V7<OadCUX~NgaIW
zoE?97OW9+mU2>udzR`NN#6w0dgFx#Jp0yA5gN-idu(xm^U&!i%|Hb*X!a37zd;$~R
z6k?wOu8}Q=j)Bz4e+{dQ#L;L-(^|CuMD{i6qW<tPI^W5=!`tbj;mbOv#7)K=2sY>o
zL_8xCxUf|E`)OO_+?F2cbJiQ&=UdNx`ajlWt`dd?uDtnmj3P>d+A>$D8ldk_R2X)#
z<Q%q*dyamK4DuKKO@jgo5gj^L$I5!6|3`L1w&uTNN9Fk5Lt@9Gu>uTiWqraI0eHYD
zu?QzI*W8l_H;MmiQm#83pulL)wl#KA`^N&Pfi_8MZfJrd+TfrT`XzB3;L0q8M`h!*
z;feO9t*83i_}7j?$@tz*rE~n-m!KYLoLeGLnCRAxU;D?b=chSqPX2njy3>^wiy2>m
zU_jypaP!TzVRpulL_P%TA2c<jZd;$b+j@7rWmNP#g`#q=^lwzf(23Ru$VzPDklcrF
zpt-$eh{;?Jg5ofn-Tf(hc=Sp*LN(F$*&zBxwtsuX%XxgoNdwv*nXBuczC26SUi8k{
zn4<|^)j^^%%fBg(g(Z!6nV_!Z98`Dl*Nr)aIo<?M#Zg$0YGO&^tNB)9#}^RN%be5Q
zPP|kJ`RCztNuzqk=ZB-}{uY-rb-c3mvD{A}bL9y+k6FQD?D@gis|&LWp9T1I0OJ6`
zv-6a5j<aW96R|*P!Iuod$BjYWEAVJ@4dXng%8v9a3U70t6yt+bMmBITh~bvv3g*hU
zfDpAt!rhXlv}EA?FTV|PFf`;YV-=a<jr7uZw0`J1Z91;%2{+vu{i&=ovcB3dF3mMH
zQtclx?xSs&$w2w^1>pIc>vkn4t@fhi$a20xY+PsgUP`Y4q>{pWl&u4}i%nOx)PC5*
zZ@NA0u{f;t+^&U8t8c+?3GT`=j23L`omb6nH6k?<3b&~0&OalsX-M&J-81$Orb|}v
zq0Z3n9mO5UjH4k5j%~sT@dy~8CFPw_<`twbNKx88d~<ndOn}@ZjkUA8Jj$wwRt0UQ
zIZ~2OdZp()I$=T4&3i}oM|ONv>y+=uW1rT)>{;}U=<RIBCkPIq_*W(N{zXB!8}8_L
zqdlfRRp>N<*Icx2O|NY0XDZelK6stHI&Tlr6Yd%*Ke`$dI`Wa;n}WzZK|mt<t?P14
z_xDJahv!dYsd6RU!zs<lZ0Yvw`p!3kx6`)lqfIhPd9F)$!7lrcU25rF7kgq^v$#5H
z(jAWE2lDa%s6%f;gr6O~U(ByvGwC3Ko?WCRNO6Gp3MfO8^@f1!Z+vA-b!Mb(v_kJ_
zEgzn_1U?C`t?Tu+WiQx^7nT6N9zDBI;mNkRJIt{BJ#S!zjnKxGd&Rly^2>jM*)2RL
z)NMB3g5aX8F?2{^kFDwIaC)bv0^*9ChbeZG%$DXXR(C$^w5}5SzsytyHPgVR0<K#q
zzxKzo+E;0+L?KCkldu}w>%-ma%B8-w;Mi$PhPQzcJ0^#@b(pPh=OH&tG|EeEduUA_
zZNIre6Y_%jlcr2TS#C2Incumc*X0+(E0TJ4zi)|UgVP9wPH832S#M|d9T(si(9*RT
zOKr{0^5nMYw;VxI(*p*3vJ80L#`%Ch-1&<rnJ-a$wpn6wAFDv?^b8LClN1`u7=et3
zQmsVr$ZiVuo>uxHQN>M+5)MX_BIn*0myrqE^BFrQJ))U(XH)7=E@)&s)-eU-j;tb=
z+jqQCwHN)1+}7>PGIMT05NXO3P`Kw8&$e+?|GGh&R_;|SFs<UZe`J>sd8_br4q?6L
zvU94;v@#0uP5Pb8o2Wl<MhkChv$x-^qcu1VO&Net3e5fpSQzE~@`b;9+|>6#-fVPX
zN1n)bF3TT@W=P+8R&ZC(UZCz=Xxu#JY^WsyvY_>Q60WK<q97z;cHcGY4N1+znBQB3
z=r_b>yV7`+UlA`}9&dim`K*ePpMMv=oUj!}$V#G#Ue#xHm{FDE4o??PGSC=RfQyW<
z^!Z+&{+Er?#IW!UeeqJY0$Nzlbc@W_h!2~xG1i@9O=SiL;mEWs@TvU!yfRI0iDlk|
zs3siq^*0ygN49WszTC($rt~&R5pBL6FMfy@7k_gbWl5|86ZZ?I^8vW|nq|sJ6<=>|
zA;L-6Jj*%I34;^zHUjbuqK^7IelI;|X>d=QXc=P5R!}x?B{jxi;9bz#)j8f}%zLZP
z7#c8JKUk*c5-5(7@1Im@3e6^Vi50<4QeTUyHw6Nd2p)-rO3wyK2THkzO(@kY1kwpK
z_KtsiZ$R!pYv0hBjx{=vC}t|L%q+IFkjr2*f7|a{ti?(?KxC8FkU5?i?z{6_tv;>?
zPrpg&Bo-eaA6UIm-eGM?%}%+q*avJn+6U>~mY8LEBdfel)A<f3!J_N)wwDtZUY6z3
z#)E@=+CJ*HoBry)T#04R6;D>%lk=WJICoWI7*t2Ujp}VRpcc^|@MAsW&{ZAAQlf$#
zlr;Wn4|wo_<)aV5dLfI8gFAFawTm9d<wzz*n6(Uf$<D$p>)G^j)eI$fvlt*l%=6KZ
z{k4OzI)(`kAs0vAvLWl+mq86AYD6U;!BiBDGwPC1g&J3z8qzxpe75t0B1dR!9d5L|
zf5?-ny-fx{E)bx)))D^wTN9;6)T7U9XC=&q9~?B1E|13{1fb>tivg!rH2+>s^7^39
zi@o0KacH^N4;7BNK>-Y|`fL33r3Q)ttd7w95_*3HDyFFF)C@j<xcJ|zZd^|T5FR-C
zbz3X!#6`^`zH0X@Nrmf5_FlHk;^J2u+=WForn<5_^+X%iyvVF5es4Ig1l;2$iw$qD
zldD4=P}>if6D{36OC1Q_jn#lO`3ZM_B%jAK6!{OD@H+C&WsMDS-b%n}BICShn3YNj
zg6&-Y+4p+;EKN+x?QymjiT4-n53<i-Rv36u&XC_C$pFa)cAs<tz%^DFrI$7B!!~aG
z{1^ktB-{7{8y<bXrY)`nKFmH{)Bb`d`IgDa;&cPaDWg3Y!N?3`<FdDTAcw|dv}j&j
zzyIzJ#<Edp$>Zm{G{$LYVD_W7lL>~Grm<k7L=-kDXt_YOEppx8$)`Ae5G4uB%i1YW
z8ocN6LD=<@;<q%?ab$A<T`vj_^#irvIA+y-8lle(b#NABrRmsu6!=YamMV^gmOn_}
zq4<)D9?1pLPEX60T-6;#ua?fS;_*T7NlnQQE<h%rKrR*lSF~kBIPR<?D)&2JL0-$`
zFf>;tw#8Kp*`E%H(tVp;CTTQr$D43U^yvLfwLpamshdcW8FRgW!%yet8<Y?{g$3O}
z9jaAQ`FMUV@TuDeqX$Fg`hDqty$J6zRC9WSJ3f+6`beQzAe?(ok;Ipo=3O&FG<E**
zxVCbmO<KXb#L3!T76vD_v3&miV!7d9&b?7MIW)1?ps(9)%mZ{mtfeAKJe^M+TUN~)
za1z3A_L-T?jA4?T<_>P(mRyrZEi10t+mj&R_(f?gT^?PkK1Vf6oV)~aIBZ$C{{3TW
zJ+5J;{`8>SC&M%4XMuvehv_+ByVqkKPa{bx^jK)hlK4hj80>7{Fl<gC2vW44fqO+O
zUJ-CnN4t?fiyH(vgBx0f=3A+~$g~S3Whn;=XDs5GC+F?AZJIW-A<z<Hf~ymMb3So^
z3yc>RB?uKzfkNkyFVB(@q~&~_XcCnCDgsF#`s@2k51VPSw^Vf&Z$JVS<7qUJ2tjR@
zZ-Y1%;gQ>2O_&xZu&Kcl2btfU9%Co5DRkWZU#Vo5+Je`+6wH??<(|6ADap5TI2Iq$
zZ9P!nS!&iSTik~GE`)!iYo0mTb#~6%`r0U$Q^(^V&iM?Jvooy2p6rHvYU>~7)~Hen
zT(J0}8${>zT|9W|s`04m_AZUDUhtGop%#%ByFwqervHDWNrXeeo-So{%x~x>upcrZ
z*5`IZrS<8|seYAy#A3g?X3sWMP2+<w+83P4)uP|*#pOU5Kl$D?<*oq1SJP<5MqP0W
z#=)a?&!Xp0<a}U!GTd?JQ#Kq*dIpB+mfGFB8tnBhdkV#ORQkGg^wE!dlvjd7GA4p|
zBJ-WJaXvq~rAkq%r1`)IoiR`3^}sI4Vz^!@nwT}+m`kaj{X^UubxP-srF#+dg5SyA
z^1ddpCoj_dKtjE6pCz+-(5Gv}sX{cmOe|*o5%ni(REWrWv4=CE+DPEl7A9+>uq*Iy
z`@Y(*OAzPmLfAFjV5!Vreg7GkjUbU>K%2mq{TYYW6qsp_Q@^!D=iWQon9<=z3XKpR
zf1zfb8)*-8VZfq=>v)VdZh8?Z%F33fl;R2vD_$}!7_GDp_lZ*pqqq@1SgV~`Je1mH
zB%lJpOVKjDI|`B8Uq3L)zu!40i&(~m`<YLfqUKik(0H5%DK*)!Sv67cClDB%BDb9G
zYTsU;0eLcfjJO7qk11u6dXaP8x0VRyFpYi<%a}CXiV*VaDbeRpFNsij8QZ|(F2-a_
z(dyX`jteUw?BL1%G`RvgO&oRU(oh4A9k>RaX6bM5Hq7^zsBi&r-{xTnWh)U6O*xI+
z-PYa@ZM};Pb2<Cn-qhnXTP^p;bDI%xzO2B1tCDK}6mYq&spV)=&C$$)af~DTg_v$Q
zEdQ!csWI`5uzGoI0=~c@V}DtC<?#s%rDp|A|5d0sx}9dWgL5t?m`eGxkbLY8i8zJl
zxd<zsS?YV-UofErxkhb>m~%t!Ct+b38a=1U5mm`>z3aO|20^*RJjd_mE(cY@xd}2n
z9B`e5*4t%oKOu~rmSlwIJ~_?X_1st}>a=dbEymZ|ch*Gsse~#Sj`cJ28P<xhi?e{&
zd9k}YNwOnkG-^Ko!1*K`L6{TN;MUeZz&&o8(ug!_<A-Fw;$oO~hT3jOt!4CygB%XU
zRy@&uKTMu}p)qNB@USJ&>sO40=xboME$^N}?Q+a_h*XlD-isR|mO}GD`bZcJyyH9<
zYFI5TTM|viP`<lN8$2+AAA)}i8F_n(G}sZBjf}cNQ`l5`NT~0$7->4Ra<SR#BUgkC
z;VEG9V}mjw1}1=sf>r{ja@Gk)u?Gf@12zgq1uOeU(iRT3?D32D>%L~I3jwcg8pW$m
zb>Vhm4|T@O=UW@{ZqA{l&Rv7pe0bUW3y<6ZKg8&!p#+0R+UUoPiwyp8DI-BBF188k
zY!=~3$rUozPH0YoIFK@AWl~u5WZzLGofp5NXiGp|oHGL#403asreLLw`bF36htI>(
zFU15b?I!W*xBo&tH=JejMpA1?!suBLHponH?O*Wp2Yq1ds5Nz?w|}@MpKgEhuJq$h
zjuf9?+?5us*zhG#E7t?m&RR1WabB#FL?MAbEh)Ht7<7uqdiNpsZPK15pu!=C1Gjzv
z+B2atGHhRNYTIAaWO&?RMv^suZzn!`5)aJV=t1<A`boJI#5oC@TYYllu|p!&o)}~2
zkQ$*w1%muWA{jF$eolz!AzbI)&PqfFga&gsK{V#5x#Y_SS-4Fsqwcr0sTIRw_bc;J
zXO!OeJYfPS^t;VZh`aZBPW^Smb90UkS9yXe*-)*fD_BlPc)r?6VE2SZMiPyKtB+ap
zoYf<=)9%9Yg)6uwe1_GZloEeS6vHu1ux-`p#?0!5x~gwY@uCUa<|kRshtkKsVcNRu
zU7%kh_zcWO36QdwW$i?n124B>vm{fm(35?xfK{lJKyG_H9<Qb*YlzQHKB#ZjKIYH1
zLw>W4Sk??sP-4X%K1+Jo-?)%UQM0S%J!AZ$4YH`v0ogr#wSIYVfRQ#`+>ckU?OA#{
zN|{-w8PiG|)TKDX2~EGDt&Pa9E0{-8NxLu(gV{ZG;%+9t3By4mhRtv&6zR(Q=*N92
z2BE1wz;PEVa$y<D2!h;I3%Y0*?<a-z`$ma|nLZmG!IXNtk`p$gB(iV@=E%c0b1!IK
z@~hy66<vC=jo7LKQ7{y}_>F^5`M{max$sj`Asq+0f(SVAaQ2yO>EXCBQlj6_v-Rd#
zj%$<5Y-i25v+&Rwfp*5!<e_z)7%Ol;arWcCY`KdEqP#}`iKt$C->5x9cGda87?H+z
zYt^z*Rx)XH7lGPXF$x&hRk2(qn%>>?&RbYLVKl&w2DwKP&~h!U{wMSQpGHo$qA84}
zz8ePUx_9~m)kpWDyUc`O@eft^{=aVA5Y;EQeWZsD?pFx~i)ZsZDx!J=4n1E-n;mo<
zZF>bF=b8wyWwX0J63N{iA{l%S?yykITXyufYa<@$jh#>NsR$z4rjI<nTvEFJZ0Nh4
zEQSt;ve48e5Ea2I$F;nB=4j_+or0LoJ6@_Z-|4Ie!pHpFYV1y<Vaf^Do7^Z<102DT
z`;sCaY^E{g&0B)eZ+4Bt!}q~`5Tc-IL#tsxGfkvI`5`+TO`6@TJswIZ|I<0?(|i$W
z)bkM+8>J&0(rr%xjrX;mmOki#s;>L2Gj_dBP-z3(8<rQ%6oedYy!s0j^T&?9OFmvw
zN_M9%B*sXfc^O-dDXkcCnzo2s!7cH7Zm1-PJK%Z(aGf37+2NQ(*KTjd1aTXmPS|u5
z<AP9WttkP`2adR?Rl5i`W5WGI%?JT<_xf=01x%y7U+uDcLYhUfrnfJy4E0lVJWD}x
zQ;sk+tjUqpi70xTCY3=6B^ECFYu|PzTsyd#H>atgf;dw=SG^j<;_(I#p#;d3J|}6c
zeW|^31hP5?kBMavU9W?%VJC<i;+W5o$6!>emhaN5H*wy>h)sy*E5LXT@M`<F5XKlg
zxSr(D@9rfqXJIvZkI<(VNY{9%*Z-q;+xhdk<6$u5JXyRTrm7Rw5S4Z>-E)?wAY~*_
zi{Td{&MECF_D3nx+A#*2a+ZAcjJV~!qqbdK?^Lu`=V~;zL(i4cOy@0gwqWm0t+HP<
zv_JUzxoCvK%6;{Q^#g75`4~ZuKu8^H<Ny%&;C7WT+2Iy7nR6i}C%jc{D}*j`MWE?7
z{T<{LLj3mhrb7=;PlqOyb^`-7$xe`8{Ok`|r~f?Ai^U$oj_J^!!3OU1r}%mG^Y{`L
zfGeroQ2&0#l523TTIpkr9!#k2uUge$I&GNoZ>&Fl?=)MuYmZY$8gFm}xqP^^m}Q1K
zqOMu8Ea)TF$x}+_nO_FiRUzGvTFyT_ii@$T*3+03Y<6OegS^X=d?@5;KoR{>mG2LO
z#=(9%D_FM3`ux<gL^%wFlT-JXJ=+U(!BZ=l6mf_-W3sp}vd3+a)%=a^Zbs27ZNa{<
zgralL`W>F6p4^aeTeyAvm7hv0#|>RmDQ2;4!{0Yl0>mBA#$XaHE0Y${y~ehr{}o1Y
zp8g8;^YQQdCjw5oSYs5-pLnufKvkCf{;%uw%-N&oFyDh}b=N7fbl0cxl&DsL(;jTP
zt5e`l{!#x>nbPMrH9{tuB8+Tk5xs+ro{tWjBJZ|e3kxE?B^ZC{HNWxB8xT4FhwJ)a
zPB+R`GvQc-es8f*7$kXvYqzrlY)wC`wzOe{ZH^#O9t5U(-fTpWZ-fgUzG$-U^4Kkv
zigJFbfH26(3U<=0aX%lOQl&zTK@*N&>FS4?Zr%x3B&glic#r<`0{!R2)KlQN+aF<n
z0Mgm#aKr)Wr2mbWResPR!d2X|jN9(QAsA7yd2yfi{b`U00~Cm_jdN0znnsiF3z#EW
z*j0t6?Pe3|UQSunOkY8rG!UzHH^dbaC*nB3Y1B_m*cOJ%sNd@)Z(G+p{f&_E!f1mO
zs?hky9T3O+7dJ?N8h>5N3Vd3m8UuXS<1^od7tsFdGfPyoQvyK8kOnfS`0m$q^?|@0
zEZLkFOBT4Vb$2hz1${KG^`rs|&C{RO`xnngK%_f|KCSY=mIu@I>lhU;)f(46u~(-e
z3?n$QJubSk22Yx2Eji>ru102JfG!`+v!R4oqePKPO>9`**}s8nLY3ZYP<vm5O50%S
z2t(*Lih#2l_D=C~0h&WJFpVoV*mmQ*gP|V-c=oc82I3Pe+>WqRh^cksy#B%z`O}T2
z5<HqcBVB^K4u|3ldmYHE(!aA=7u+yNz)HHY+P-Lk^1(X{0M|QLL8S5qV-Fb3ZtrZ;
zWJ|nmQi(!=KwTgZMo^xiJo%B#Qn|qSeh$HCJ)5Yvi`NuqSCFulv9Ne*0VuEGEsC9J
zdXndK?Q`Z!Ou8biF4mK>h43Bo@mM*w=p|Lg(Y-{-Hyyx3?1$U5E!HK_bO|;%3Ipty
ziCh7>EK))MmmGP~MPDubSpJ;4br0<+d!S^-nL|@Bnym$dv2W-Zs!#Q3WYY;RHFmCS
z#*~nCDZNAAH3YHxyd7ZZ7N@}lG~7e0LdB{4mn~W<+Y3Lxs(rD0z`<mJ_2+EvB&v8l
zu2=xo63@1e=;+2()chA6vG=lCj9nj^UVH|Ba{ol7-Hd<~A1(po214o`Bv5hyBYf};
zY3RwFG|1;es-4@vSfs|XRo-%q%)YP|o;C)BP9FeA!ggv+p=D?J-WOd5WLjyIxfSq7
zyjS06@)fhCzwY#x?I}%$n8$Y^MrYc66>G*dWrqJ1Kp7C94yu3f-1Yt?9ezgO$<yLT
z(dhc>;1=2_wn5JI|0aH`h>|;WH_hS>fAj`n?2htq1dLPaD1y-vIaTWYcG@=Y``t1R
zT#>qxI+X)25d9#AGw9*%wfH_qnN|EI7|Xqep*(vl{f?1lohp(S@<2Dpf2M4u$Jrk*
ziVuxgv$-i2f##M`dcS~&(rdUTKdsj`-!<G<A*g2`d;Crhg%)E`(ha?0&ngSBZKuyh
zd4-Hvv7vu2dMXNMKftOQ81%_Mx-R48ovrE%NSA3k(gOX-R7(e_t4`u$rniR8tFV+2
zIc=&F4{EAPbBxX-?G}J<JM(ziAeJZ0Q)KBzSg<xFp@|_27@<iYZO-JK;QB#Ox6=$K
z1LfB<*kdAlaIW7tR=V=a8NsW;2QKrSJXb_60>dNu5Z_||-7EB9Xy31nuh745ygJiL
z>z6f$iGKeJt`~Zyx+CsYeihKR(<XYp*0(<NJih+wl}UOSi5DNBy*>ZaZ*#x3&2t}u
z!!H9OcASbus^)-TgA&hq^Ka!U*l>CD5jAB>A?8OV6_XXi{*R2LhD9cm`({usu<p~e
z)tt5|(PIxv)h4cEnG_|fks=(^wRQZV+;c(v@JYd(wYPRr#e6y0aEHd_6W}YApw*$Z
z!*et{oQ<H#HaR`U4?jzNm}ARK56~yO5fgqV^EwL7xB^pU`63hT)s`o3S+9Auey`20
z^EI8*I(EXgINH6J^y+u+++ogSUaP!E!00b9pT{>^R}<;c@ACX~6x~7u&z>-<WZ0Q}
ztXmsD@;MRin@T9GC^6J6?xEG^Cg+<WDa7a${_0=SIAR%=`Nk=Y^nBR1G*f&wZr&B%
za3=1BU)<vT?6VhK<HRM`c^~0mdYU`Q=TNgcj8G+!-^3aL2yOVL)CC&62+A%UR&-10
ztUuU@uHdCuaM_F=0NgKx%G0hAq(7RlU=x+ul!yp}xbuzs0qZ88Ma6@%{Mq0vc~uyW
z-9w@_sbPJ83(=6?9hBOwRy2)nG`@lncWW=}cgU^lo2y{1t{o^*LS9-KCD8vSz`-|1
z$-GPlLTe!#v?r@A>wSsBqTx2v*nvlCQDKkae0;tFmpcj9=g!voB1_Z;+LWBIAENTp
zD6JmJ2<Kis1rtpZ7IpaAvq3zuacYH?0@3$DtjFJSj&MFf-S5;?MFt`Id$STz%5$LI
zu2);y8>}TQ;~TEOcb!;w#pSn)kzjAyP|>0?QvYVX-VZB)i!D3a8Kvib|1m!)*w(?`
z9B!Jtgi?Yn@)}22`8+Sh_CugfXF&`Wexvpq?YnWgbAK%$3+Zpg{K29L!Vn91De6ap
zHCs&ce>!qo@C)&?LE@)h5{Qi8-YQj_ms$hfIBKEMtJWHVr{TA3cC6!riQ$+ABF#Gv
z4-%_#b|Am6F05jR!AeJ2mTw$gp8K)Iha2yRqk8Mj@80VP&p!<l_e{i^rfOI^w;*!$
zB()D)3E|4}Z1AldB)u=XLfHAuV>{;QcV3nBd%zl{K(DaB!GJ64u+Y^1ZbX5q%6d8T
zj?$Uvs!6Nu{8u_%jh%jk^|Cgr)Li9tb+}f}!(4xUxylyTz7!UD^YR}K+p$uuMHrhF
z!$v=-8Hmbf<4RN5<$p#aHZH#67bSX5Cdm)!%U-WSd$Gi}E-&Xo>~01xvsk>BLZ)(A
zmTrIJ%bo<j0?>=4KZ6qR5c#WR9gc}Y4KdqbQ5ZAGFP~tOP@~F}{gi{Bk_wIqwlN4B
zw17pl`R#FJy}tX)0Elf6)y$Y!k5OgD8n#mI2P^*<0fC-qR?tA6(x9Zm`Z<T=4Y3Na
zuE)klfiB-_Y;GQC(5I~t&ePW5{`sXEw!DFccK`9k9HP3Gv#BmWZ2cn#qD-iWtQj#h
zav}%TBlRj#?c@O|4s5XtIa_q13SGOaEb7(BnLD<{Hs9mXzNlG_F=B?7m0lG%_s7mU
zjGL}kH;uVYsMugesx>HtSNPbn!qM~Hi6hRNaFe3N4;&=b8TFn`EdE(sED3EaI2eUu
zoR-Z`h|$u49Jl}lh~LfdKP|r@q(E_b7yz!VhN12fw)l}r5RvNSi#>j<(^9`-V&nGn
z+Qc2$24Oo}V+!hfJI=Kr2c=<}4&sfOx!?5Ps9-|R3j?OhhU-`gKZKp<i*riT7y?R^
z#JjO%XI%3{v}c6y=7#+|N=)MLp*^?qVLV#`MfMCWK<>+gJIe)Y*2wm|bQ^$77kVQ`
z14tDPSShNQScE~9kfDQX0o%M6jxN|orlLa_2;^O~KMN7erYPT-d!7C{SB_BQ06Lt~
zP@LqYj;7jgzTD}g5tX%~Q3E4L#u~|)bGrNAbZFYnhIzgGM?gDcDM~*2r*{rvfv{B%
zuXureKg7pk%y8}87v?$>2HZzkMF>&fdFXi>qXZVdyz*y?9C(~CC7#};vx4?xKns&!
z0j4K=E-j)75Z=|Ph<A(OcRMZ>*6~jQ^W_$}vv9!1bA3rgXBbNzPKAIKUg@!~SFO_e
z7^!=*DIxo{Pd9=;JKq)$Zt_6KO;b8%^Ss!BKcz~k;3cyN|D=QevBLUG6xucHp=83;
znxBH^O6QAncuG=@ZMMch>alJ&1a<iNY7X*`)Ffl9kv0lgVUB?G;!eb9dyoyvN4F<c
z=j-NqoF9z{(TFU|;}<*iGGhY5UU05N59xU09A8r1*Bs^`cZ4a8Zf9le+l?4#<d%-$
zGGDHp&T^fxx)6$jUDh9D?Xn2bm7-kp^-OSbiEMxB)l^I@a4gJ1XP{_0H8@u{%qg)n
zpu<@vbToP7M_tenu<ev3x1p~snzckUO;ibvDHf9d&@^Zz8Bsganj2omC2at$lNSu~
z8evRd8D|WcAk%urifZtGN24uaQPBOaZ(z}zdv@Dy8^%&mb0w4O6@cu3D=Y8D+VfED
zhZX;F&fngq?e#BoFakhuPc-1?Pb6&}=!CzeAfTYaR-0Qm;2nj}tHs81rn&pshVc3(
zwPyiNzpW{sqty)R1<z~j`9epkije_d37;pZWoY@<KX?w@B53wg3Y7f*H$a9{#U1iQ
zB7J32G)dBjYeJn+X%SurLIzl?6<LVEo$xY#MIyZQB9d9WrQ>S%p_iR%@pcBM(>=a?
z6R9Cgk^5@<3%VPOZ&xtPm+88llqa^*94j7)SO`h5<gd-f&N*Dw8{V=xtt;@IwCS*%
z2$dbxIc+q{?A&bejwk%^cBt(Sxo+GayNTF6;y$S!?{d2Qp_-@+oo>sEaWD0lr9gLy
z3Ui)po@IG8+oITht2Fa^f2!7GhUYIy(v4}k;EG6Sdg=@ECA4^?zO;~C@xtn+Po{!u
zdQk6dmDk3ZB5Afr26Tt6;EjM`@4Y$UP*(bfR8_)c!Y-2Jr#aVK99Un|(x#bqHHpd;
zIwp7{hH_)rcOXVj0zc9Qlowc0xAMUO6CV;@jz82l?hXj;oRN$1O9gbXyFAD~FDFd1
zdPf(>8j{SobJV>~+hAk>7-LRU9T1Mjj_ZtMhfw4T*?EA|-8bLPHQ6@g9O^FAx-$$4
zU5P%dz6YoXCKd6eNE!(?Ru&Q-usnqgicUipsaoKFlUs60U`XZtw)AV)^=oOjQxf{7
z-vM!-lls-O;`IeNmkd6G8@`NmfbB)tCluJ2OU-^+0_~QM{JHR><xFz|e6-0+lGQiH
z)G1dilz*yaTwusuZL$h<ZaF%cvfh0F?Iya4T?eOo-@g4&bL)INUB*5N9U$dHmm9LK
zQ1o3lVs4*a$6iZZAJj!O%Tz!fnLzhluJ+TbT@hkW%F`&|$uR?=(JRgiGYv*Xq+#os
zjQZGzF0%}k1m1k=w(&pr$ChpXgzV|RnC$ZM$2ZVfZBS%H+YJo1tiTICFfA4`4*YY$
z7uv#lIh=X&)-G=v@H9XzU#-N_;0c`;aGRf6?E=sg9{IWcIpaUOD*I<G)ejaPtKu?q
zPPnVz1+dCf3UE<PurE=eP$zOhzuUCLrGCzKX(An7LPt-&6VR=>AkJ}M$Z8z1*TkgL
zaPhQdiaNu`(g}j)iY1ALk5?>VA~$AM8cyXoX?4AdEwgy2<85H@Xl?zuVG76_x~<bx
zTuA!7A10fjyhbW7EZf0(LWP1$yN~zZLwEjr=!}UUh|`Xe1|J#W1pHi?*g{zCmMt*C
z1ndRM8h4~Upk2(`y?}}Mp6~WOSFI!YgFm)M1D3O(n-XJzu+th_@NA!J=~4zJQk1gZ
zkayyYq=X2KM0AhMw*)^g#PuL{^N$szOvwN!Jq>fDDskzhXPEZ!U94x{>=V1B^_|-P
zt7quO;L#uB>j6VfShJS~+4E4|+T|#iEh+GQyop^x^MgSH+T5p#-ma6j;0?{0_+=Oz
z-m8&6B`<m0DUjnILF>g#y$YXjf<aK=P=-STfq_gzs><_te77Ip>~t_+HIZ$|awY@1
z#W-n}qc`z144jGhKu7#jnz0nUUDT+cQfJ)TXt>fkT~zI#d_xYpO-K&iCR8)Kv$Y4A
z&@bDd`tPg-fz@iu&&5;H9!uSP<TTvbkR6jNRiHvml8qbwe?3mzH@`M#l>g^x;~&07
z&+C-7>`!Tf+G5a+Mhtp&CSyS2S3mvdJLE66hyS?)!~eO%pO;YIo`T0ZI4_@J%n<M*
zV9$_d(-F3{b*?ayo*-QjA90-A-LKsS`x5zwAIKrapS&a8J^j-^UPue=PrE{UHlG-Q
zAzUhZgPVjKK9v_I;oYrD^UtPBvpLF;PrxVNa3hTXx;*dorBRU4Q<xbkW4R!E`stq@
z-L`of^;DXtvlIWVp7&7s21Y$<Za(Bt9oVXmx31KmE{`A3+3xtQFk0<I>o5+`N1%sh
zJ;ih9EN)!NZ8dDPj(P69VTv>V`X<Hip$)?*qEca8*{H!afqU9z;EYZ|^u-pu6cq}B
zZ}YR;DY)yU5+?(B2gQj9t{A-mk1`&4YHx3K<g8h91@8*@`>^S|1zM)&UU*{lxCt6L
zwR`svU}Qh9ezFg^a1i_JcbIkcvkbg2a;+4bp(d1Zt8cd(*1Sv^stWnX$N$A%k?Imb
zLBi;gjf3%N(8w}n>;t7p{);<AX_+w;@aUSBd^AnuSP#Zy5%-T(7>|N|N?uH^Ktjf2
zPLmtP%b7e!8fH8XY?l|FUl-dRud4<B;2iC4<3{6O4~MP_FF{>QBdeKJnNnogrkc*h
z?q2Ss=2XnTMIOH?RT+9jAoPg-@<%!Dib70Vb-45p+Iz}$a|CCJ*msH_xo*&Tj2`Ir
zQ7;jNzP7X-F6?8wph7w8lvADV9}@Y`5qZ!f!cLlJ@3ZeC&b?=sagUiF(kP%iylm`(
z>OP9~dCTuBMwGE-cg$6uq(pW)Yrw7Iu-IwX)cdO(T|JQngc!L{Vk~ksY<}$4v33U_
z<5KM-y1?Io$=lKmbt>6sl8DhKXyPZ^{`d{ROz>}zIYBkaFeJ5P15lfYd50J<B7h!|
zr$xuQol^}Ww-l(;DcV=5%~E^&;k~*9E~*N4g*slac;Cwto1bWSZb>)lAIFEN_m^MK
zs~~y5*Kj~6V=2#sCJf`JYvGbcAN^W>+8K&fzM8?^@7sHi0>x&#DA%e$_5Zno+7f{$
zmp+hp{<c7E`KNA6DRvgbfRR<{SBc*d19fHh$(ojfDuVhZGCP+I!5#i000B9MDt_t1
z`j(%XWlQbbT0w+QvRCP^l>Y)_LCk6WOxlijO^~U({(X$4>dH&OhSjRtrd&kZ@aYmw
zic{uAwS{lpgy}SQ9qoAF*!S&b*b|6w<Ua7%-#)N-;-iks&5-V6Tp|hiiA;4@1OI+|
z%4t2nJN=nijjcqO&Q4$U;dwTW_Hx&%*6jxr?tN=t9ZS(>`8JM=xe{8qBA38n_!UyC
z<1g)(&!ona+5)Axc8H;QCEpDBKD$08I4t0wGzte9!5!)GcnD#`*4|jLCq*gu2(?1}
z_+|3su`X+Mr5C$)>r*a0W=7mo5-&G%@ic%ATehy>1yN(C^Cx5Sc%|6l#|7|IJcS~3
z|8fMn3z-GoH5_e|Ux?pD^#}Yfd;ABOjjU$Lf1gYXJ=w`@caXkW{sGQpr*wtt!-old
z_UXHF`+Gp1i~?r%jdY7MR?zL577jR8#Mp--n^iJ3W4baUe7mu<@%5tWLT}Z_I#FD}
z4QBtN+1-ytwMV@NOPKU}QJhP-AK-_d;f5-euV)AwzR%JA<qOtdFCJ{|>z8ak0P@=M
zb&7;VE5-^oeDW{Cf-R)wNJ(_utfm-<lk$;ijmpo~f66{Aym`{b9>s}z<Nm?u@bBnU
zH+Xwp&ri5y^R8K5exHSPmjE>vyFtfNjE6%gkZsVUBKr9)xWl1H@|ZObVQc>VUFZ=m
zx%itHH$>0bIy8|u#kgN(Ej8e7kq?XxFcs44d%_tn@!R;q1IVlYU@@8hv!8n}PFx+X
z!DMuH;_7FO#pfC>3#q*<?k3~P$DpU*{6nwOURAuY?p%_RYUh4pJK+nWdM#|Lth%ol
z^B0@7-zq>~e8kzZP{?mrfg>5$QNmqeM9E_>G_K~NZvsK1b$jrLSIOnDeKCHY<2i0y
zP@i)r!<$#o&6kxxpD=P;6LPL{PuXKnu@gygb2@6RI~~|MIY~EY>l2ZY@DxRWf8mfj
zNYFKu`lro<@I1N^Iu2-1MXpfid!i*F6V~^PJ7luVPdNN+-&xcmZ|XDEzI(Y=FF4_*
zf5E&_B5t)&F$UZ<zaSEK#jsT(9kP?1XL}Smc%OT?Y7ATx9-|gHr55XxaBs#iI;f2B
zAzOUEFn7t<SayFU*es@^H;*TDM*o+o{Uu`#Q1jKEe(I7ZuI^@+*NQ4vjFq1*`?bg;
zSyzmG5!}@3lL1fEIdLi#2}fyT0+lI;Zb%<$M+79o0)7SDGa_wdeFP-DITIce18d_o
zR6QI}2QTtS>yuep#~7QB_WsFdp^=mdYeJz=?Lo&W@Cc}RXkAQi%%F<9JQ;jcynN*V
z{)Dv!(YY5tq3%K}8kmkszIp8IALdyf|59<dDC*>2fz5iNq=`Fhj_-QbYY{CaFud!a
z1}P4hX8lDru{^#!xx8|-541}Wbiq*3BgGObY5i5OmG}Hr27;VKQ0nsdBgB{od#{vV
z`UIPY<E~qpDro^Xy}6~-tz=EL3kTp*PG#`IYjVwCG){hk?Sxe|W+37teFni*A@}^m
zFyF-|r>di%<6*vzo~y?7s_Q5=%8SBVH&TQoSp2(7Egy}o>ed?a-J@M$=wKCk`tq-Y
ze@|!n>IE?vmw-Hlxy6y(#WO)<PTb>`3L<qZ%lnqW%w9h08|Jt-Z&vo?_S6lyc&eHu
zuwzv2{2YUt2o=0CUW;Zkq$_xtGf}97c!^97v#n<I1VsFXn)v}B^PbTs=*UAqLlIz&
zxC=abDr(KJ+&@BNXJ*^9<U*<9k`NVUe;%<@$qLo#6a`gCDGfChW|+S&M^~9@6z4>#
z7)xM2PzY|Ys2GE42jIdRi3tx$mZiw0kDX?;b4{{1RP_ohKUPw+f&PIq>TZmVY<epS
zV<(C|HX|X(qg<k;`K83IL>xq{ur(oQAGqu3yw91=8-pc;yWVl8{;Yf7Q0g@;<}-5T
z4G8X}-vJ4#dx)`noXeh*k{2d3Akwx%U7zxJ5`jxrr`Y@B{@noY_m?ekJ_ZlXiVrpl
z3Ac{}XYb(0_Pnz083S53o)o7`cDLLScMy5b9<(3QLhBw_c}^Zmy`SYptm1-Ioz6&j
zmKSS+BvHq*cr9o53J6_Sll!4#>9dR__*177x^=aC`bDMR%SRozZ`BIt1|vn&IQk|z
zSyx%rlH}AY2<FCFfRSCZ{Qa;{)1&Ek%FrCPw@A`6%Y42M5Bpj^d^%^fN#e{d@22k_
z0|;*Vv;<pkOK!=<fD-$qcA0Eq|LFS{>c?jJX?4bGeHs9r)Sgv@sdV$bVkR5rwbhtz
z7JbAO(_=e*EU>tD)1s-pfpXYHQi=bmypM5A6Ia)J39fH+!=HB{<sx(GZUiG;CK6EC
z8ZzDv$VqNZqlfHGEcXK4=A2%s35{P?&$y<pA;h^t*2;qW@wSQ`%}2E$UkA?#I)@x6
zop0QkpeBHmn3Cv%h(X<1ABA*aRm%#eL1#z$;*7qlE$NbZauPNp{`N7SKCA|>)i|b?
zHJHmH>nKAQGeDj%Op^4lE#%rAmr*5wlzF)n^I}-i(~UynR(u0Ojpq?%_}IcS>;(Nh
z;vlrLL3TEJjdb@ajYZ`bApZI=S9%wChq`<;*euvO^IkcpT=ZYnFg>HqYRoC~=<~%H
z?ZcGNy4Kp-uiOnS50yM0@e|<-&mW3zal5-;D(FMvg7;=<9r*N%Ze4>aI8=tS#^M>h
zZPq~v1*_uUo4mGMfg|Da>3~Sl!d9@x#PUz&`DMB9N7{ZcTbAP}3)9CBVV35#KN~6p
zUBQBnJPJqMO3aHVX5MJV=HEk_ZkzF-$^lcEXSK+Of%5Q9nU!>6AkM+d-;rr!j+sG5
zZgDS0B@XY%qb2moj&~fEDJN+im<4izS_<joLD~M&Q`nu7%T@2&PrC_Zvw$n-qZc!0
zcGCyng+1GNPs#C6E1u}?=5-|kWDMRVq2knWIp5QE>A!2r(0Y`?Pk3FfT57gYs<RQB
zWV-DDH5Y;N$-m}G6Ynf>`f`L!=cTOO3{bk{{T}!##^u>Z1$NEnHCyDJ?SJavc0J(h
zRQCRMwL0aGI6@lTsW?TPI62()5^LwPAh^^1-n<dP6baL!f^d;3>iLLYJ2CB7K$wfv
zHx;2({}glp%nmwImL6^~DWbs^8qYSXI^u}G#E2_@<=-54SK`$%F${d4Y;Pv;j3nIu
zUd=ar$kaWq541Qj%*?au$-?3XB@*IOW}eFy@tJ_p8CPcV{nzUoJztynS4!lJ4Z6^6
z)&jQ;;N3n@v4o~;ZyBhGrBPnL<X{6MWTt-xnR(Y1u&cb5#f%NR((oartZx0Pm2{s@
zbZCAJ>8`Cg2GD5??B|<8-r88oh7|VLZm^y_%qyC}UHI+c3iV@8bp1=R&ID|LJkkk-
z$~kGWq|y`Ubrvi5_2Ndqc?j_NcxIKOU*9S{;4Diyc<Y|=p3ZpYhDR7#E)unhw^LwG
zm=CwUZFt>xDk^cR>ar;Fpww(#^F$AMD*j!5C9FkjWiC%eZl%!Bc?F&iFrGYdeBZ?9
zM)HiIfTqiTF~p8_!W?%)!c;Y(qy$qk@#*-a5^D{v=-b9z$+>`kvpgRTZyhDc-S22;
z+n)udkk&E$+ni*xUmKJYRRRD{u5Eb(mF6Pz^>pwxBF<%grs#xT%oE`v+oUKI+=8)6
zSL$A0XCFXNpP@?UC6}ETs@zvf`@!2z2VqWs@zXwKk@cjdcU%`ss9$8F?q8L-BMA;&
zS@WRW|G<$OtX%=?6v>eR=n%Y-TWkY#EaUqOz!9^jr{E^um69NfqGYNio0Ly%m!NF=
zWb@-%0!BQK8!Xa<Yqn3Oove{C69s!b{o+3~@7z8}?5grE=+B<MFx$hV7Nk{4!GLPW
zhyyqDbJEdKIJeIAWA<r9O`Llk5MRYya-XF^bvpeYQeJ1R)nO{6H#}xG%AV=u`?~gQ
zr-$Z-AmIEJE5?I|Yl)f4Zk}ft2)1Tl>cu_!c%j3C(}xBlVN>o}2kye&)m5vp#yMW2
zk87S<<VVBf@4hA{ruWjf2BFYuWt2}Zg-=>gLa{{N=OXla9+W<Nl>^N(y2kV2cdEJ2
zn3s=GU?t<PA$)!J(hojFD%Q_;i~RLZn1YjFZQIlm{OQU}E&J8+tm$hj*|py7&B%kx
z{-RGtK<_bgm(U8ZF#G+~4f?nxteAmbrZj}tD*Bo#<&9{L_vMOZ4z(#bcNcBiI{t)e
zu4f!oJ)rsmqi-nVlS^0v!U2@8sq|f5jD+3Z$^OO@`?S#_&Zb7F6qvR_um%F4LTLz^
z2f{&vbo-Tz;4dA5OXfk%7->bS)~&T)>r3=^Sk3Z&4JS%od|q=`_dfs`*F{@jT8&8X
zJFM3e@e~VA-Z@&KTS?9Wl!z#eaJv~Ms@Q~WxpP?}H9<{)JHIRJ+K2-DTntHBPq$D-
zPrEfwl61OfAmyZyXP)Zko`U)gl!8)C+&nO<Y8HHv|Kw`OyT~+vJbK8c(-&am?L&Uc
z-I2+Y*-JwCER;=GPmG&o+aJt#qf@X6V?sHAeDrbe(3jU9a{BmMXDAYhLR9Jdti8fx
z7iMCnU|Qg%HNLLA%=Kf!VmS4w=V|SZc(F^qm~1EzxT+_6Y3e-l7GZdl>VEOmiwx>k
zh|q=iKS7)$5s(L*zaTm{t*GJkny=?N5LubV0Dr<&P`b>@z<fXgP3M!_?(uvRJrKKE
zJ_>br6wN@M32c#_#get0BaN;Wk8Yu^Lv6{etvaGeIp95M@jG4?wiS#FPAl3uJ+de|
zqD2LH_SaTX#x5@A_3<-P*dsif<hh9gy@6@~G%}b%9z=yV3=%+YyYjciJ;dj~SEVuR
zJ8$~ItvQs*JddV2rap6mhN3N8RwA~Eml{Kg$T(qaoBpwg(Rxl*U62&oCS9{ko3l4v
zKN4FY*$C>2ZP72I>$olwP8j0sO69M3`+rE2rvx0)od}Ooxy0-Jsdu13n*s)q=Q`wO
z`P9%2Y1nvJ-LtTMazD47SB9pK7+-aYL~Qq*>9sHc(m=(TrkgHH&ECC2CE8mM341P0
zq;RWBO(&lLL?woJ#Z#t_P3MgeD5MYcYMaX7t<{>fZ{+gr+uksc{>1Ro?##*VRa@}G
zHjDu_I~NJ`YNqgCwVKMJgcZCz@iQhQ&5MqJ(9twhF%<tQCemD2?4aiikWw4AMDc)X
zS)qP4zEhCz57i4ar&I|b1T}1BiV2foycktilK1K9uRt#>`c*N3V4t1Lc=(1sY{hoh
z%_MyZjS1?x5#___J^^+KR+K92$1mb;9(_$6`tk{0&o==cn)U6q+*(I*gV}LJvF1Ck
zqHb?k8wML^Ivdnca^V23+_Wa<c(>hCDJ%~n^6O4?@(XOxaD@qN3IB1Zw?E-)y>FLx
zb@IJcfZ_8}N0>gbqU10Y>ZXbn(QCuO8BC%DZfVI*7>Z77Nf?FyhO6u3HJJ3NKX+4U
z6y*||8&4>}mkL<oo9=W?tu82(kd8K!)lKW&3qxwmSiK`jNMl;9j?H_Bsw}mux)nOv
zv~MOuD`fbXG4noL{JFq`=3wr@pSKS;h!*%1m)}+>ebcdo2RZeT*OCMBI!rv`F4ebf
zALoOu3qSfa)<5UA@zZfAg(z!}!LMgJPlQB>!%p;x(Rxv7V=2?my?ah8GV>tx!Yx$1
zg;5o%v%~moF7bjX*N-JqUIG<d6tu?XPH{(+y9?$l2NA)fCdWKAWY5tG<zKg27l>6Q
z$$oK7o(1-1w@tiVRPHZ1?@}|@8Hc?SuAom6<EKw^c`T*R$|%klW(Jg8fymaaf9}aM
zoG*paL5i%Z8`G313^dydRD}B@qOoN?X7T%EL@t}>ojtSnm9V8`+=j6b_!=rSul<=D
zf~WD>ajLjb{m*&FJNq*R1)bj;n+u@*$HU?MTI43{C46=<af_mkDE(UADS5rc2WqtX
z>~q5MSYAN`gcdfWKbE>8I+;bAx!eTz*P@lNd)hPwHm)2B?LLacO<_+u;X&d04&n(s
zHep=LN38l+c6z<1Mt(?J&UC(R2a4pRJ!72;1>!hD{qLaz%jcXglR^UXUY;>YZTI{!
z(hMS2Bxh#AGrOPXJ){;hW6o$_F=oGW$xKa?n9MSyejltv)4({C=@0Qa6{g3*m;EOj
z9tgNKrz6QyT=A=p8S;y06+B=fK2&dhLjg4A?zA>XpsxGHCu9Uz6`IzDB0(AY(cvE?
z_#(&J+=dO7;05y%Sevv!)7}tC%A3@5<q90u6RkqI-=I&JT`wU;2qP8{l}<mw=`mh4
z{e9B@aov$S3DtBiN#flW%!3togrK*x-A|0lT2gPY>=c5kf{vKFl$*mpLAi|%4$9&I
z|FSp&#+!<<C@UNf3jgf6hwa4NIjD<HRU++@9B2vhHzhC-SR`5X;4FXUarX*PV!Xo1
z_R-%-$sFTezrle$#cgM1A06#f{ZkHkPhzC2M3TkoYhlHA3mh<Dw|9K!*U#GS8bbIF
zWl{yA9%wP2JjC>Y%3@cD-<^2IL8#s0u#8HpfFzeenJfTr;mp@w5<Kpy3c|ibq9fmD
zt{}HT5uo}!1(46Cdk*Z5Gep%pwu7N8qbTSEu`pu`pB9t(@<C#@lc;Nvtsa+s`t`iv
zw}dp*&LM;^|B=yN!ZQv-3%7-&V(cciQO7c=PfR@S3=`nZQYg0}VMXJPE|3!jz8=|n
zYvn5-UDYCg=OYCHxe>#J@14m8od4RoS7i+Rx1QZqt^b_3rq6bXgL#D|$`557vE~I$
zY8U!{i5a^353OL@AU<Q@xe}-3<jQi@g<Z}l9!vK)UaJb6%Pg`LAsRqMG)74C#I&Lk
zJy3OFGtpwL>>g)%D>#CYO;uRo#O=fSUXiy8%9F6D7uj<~eKYU%IYrRBrJTJB1_sV`
z#2#Ysx=L7gw#|i5FGzadRVXeY2_rBK<zE7(k|lw5e{l_PnXkyDv#^E&RSD)x5F{o$
zuWHvOPdwt<m%}ZK8PY>Ql;0KkSr64L-+b?ScWsWJf&Apf<>eKjKoLT@bE+1h_<<|9
zlJE2#;ay;tkow|00lKmI1?e+=N-Skbx4p!Heyuwk?7QO>>m!_oP4@0A_;#de41TBN
zbonHxEX)(%mG2SXmTf*Eot3q~R9fG{;@HXRAmfm6*;t{=1e4;eLd3y4QgghK2(-&p
z+~M3n2UUtb=^N;h1*;<aXwMd}a6E+N>1zjX^R@d;hJ}$DyUhEY{F(P&|ED>|SgLQ_
zK0WHgn}$UsZBCdj+d$Be<J$KqC-y_pMd?uOzWDy?-0YRuLqjd`pp6^Z#ktDoSYVa)
z&ZlH`cbYParBu<>Grn8PEJscf%qYwoHH^Nu-<#QtHr*6gSei<5^ExP+uS0RhdXT#L
z`+D)ZhO+<e3QA_Z@vLo@f93mjXDoZ^Tz3byRs`B4lQF&9?LD59*0&4{&?$;*4Zfvt
zBN*J}_;N@#m&}{G7+J4>?>SfVOF)7r=nu~RG|Nr|{gN2`&Nok61#Q5NGB?1T<ZQO^
z`=tDtB)-2Jo_MG=D&r;Gb;k(*kFBqaifh@n4g`V)cXtgI+}+*X-QB%$La-3r-GU^z
zYaqBa?(PnaH1hSi=ic$XbKm>hV|4GX+O^iInscsMZA_<{p$pN<p^DqjT%%PQGheN+
zNR$O%Fmv|6)+&?NF&w4iCYiw=&TVHvFORoBrMJKbn%kLO4835lq<;gT#50tn*Eeht
zjYA~Ix$A1H>#lFS#!eav;$i*7kM^-<)=K|isPyTu_Hh(zXPzMgZUHg8%zwt`I=W@>
zEb6^vz;5Y?(N3O<m$W|Nz6;CB5v9~aEt$p+yZblvN#q-$yQ3RXHluHeOmx4#?G53s
z`r0gOe2fPsIR1N#?#WCkEfu$UinNiPa?QBSCEla25P0|~P7126y_i=Mo1|6{ts}s6
z&5ZU9OHT_pck{Xvlz@!lwu@<%_7A)q2Qi{m*(b%1(5Qq~?tTHR_&~K}0bvB3Z#`_y
z+YpUPdhpMUs7-UoD9Ft4iMtnsxz?jz)n~pfx15UqAHU@pRjO^Pw^(&+v=o$U1REQj
zXnoIsTzrlXVz|3j&PRwSQ;|%iIa{3NWM$19tm4XEsOv@v?ED*dk4eS#{*gQ&RD3|l
z>9*<|9vj?nOD6pkKyglZPI^vxPJ908oaLOo`@U7;A7lnnL|>ciXcY$=&v%IZ3j+j$
z22}>&ff$&Wj-|pvtyQWx{8N^(6pCacXs7MtLOo2UKR1GyvLLKOqfd4b%@jATcYb3D
z-0X=QmJ>Y~2_iW_ewp$iefnKud>yK25Wk1+y5aKXLh35)YU~>9n&;Z>y5aiPs%Vk*
z-&5(CwOZ9c0ac43B=RL@|M=TJM<;oQTr$xfZNJc~tB19#{gdn*pa)vB(jk}TFCw(E
zsF{iWxInn4z2vmkZwbG9zr!>)wm>2p{1qGrjt8UihX}e54&(gy0=S7<t-7_a#e5me
zQD#ugG%6{RBb-f<Tss0{b;w=fAfx6=WsQn$ob|$Zi5Eq3G_k%w!AuRBzc;^a?4yiy
zmf7-q;6%L1Yq@B7t9!rr{**$OP>J?`JtTp=b_R=&p7mQPgr?({Tb=@21}jfh0Ygiv
zw=|Ep^AwQ2!~-pL_sndu`Vvr)bI)b+82KN{W-{bFOqJ&#+y{;+6)>E*hr|T84s{Ws
zIp@C^lL#@>AWWkYA%H6f15Y@!vk#SEN*(0Ty;#LTQNw*r3nMk_9ydZ{Nl{1w`bvb0
zxAP~NuAO0;>n~QcLiO_*v$wHal>I~L^MYS1c?aTOjua`svH7NY6`4if9TQwI+A5-^
zl2jHgT)96=t+K3guL`e9uPU!<uNt$Mer)%tP>pHATtsRvSf=<dc;EDetV8Z0HGWT1
zPdB?<n_i}BQ<Fge(B`YagPskw;m|jblJ-7m_F=(8*_It*z;p43kj4LrcBZ3H=qXFZ
z2?}@0=v3CX<ra;2nP`Cz;^k54o*nNq-$ur-dKX@Sevf>QdXIjOd5?XMdyjv=a;u{k
z9@tTI3Ik!7wk+o%J%|63#KA&5Ayur!NbMJ#EB|~ZH&qpmd{xF;`wcrAZ~%cAiUk=T
zPmc3WZL}HtFhhpVOMkt&`=H#;RQ?j4eW6x7dX9W)C_@a5OCuj6-G1E`+6mg}+IekX
zf`t&R$;iqW|7+;f_Y5ypEulhm;Pxu(L8|rnVAWSR;z2_Bj!n)`?ct9To01AT-E?o1
zhQ_P(1vci3@}YZbmqb^xtRSAh{C<Kd;V}1oQlSxVqFOfov&5QteZH9pH+Is-{DVA#
zm`uSp0knsWcQpHi5_~%3Hd5cdRF1xC!<qIpr>~~+xr&7Z8h~*1ifJ0I0%UM7O&nT=
zaw(bDRo-?=;HC!pl0948bG3DXqyH5vJ<KiRrpg$n<y^2F{~T8grt_LVjzZz*SN6l1
z9$63nOFTcS#jtr?tr`A^v%~&A#PNHil^Od8;=`*xClBp9R3`Xrk)4-*+mOs~Gq#aY
zY(#fJs`k<Drc9-sj{szXI0IEc!6>GEF`Wt<w3lb(#X~b?t;pcP=R`&^E=mS`)ITAR
z8OhHkAu3Hnz7FVnl3s*5h4Si^#5jfXg7M#eWP^0e{}1^A(vJC1Xa$EBLLoI^=cvL&
z+fN^%fGMInc^e$zc=%{y-NxsVjiZ33-yu}MiVII3>|sI_$4pe1#?mW~HCpu@e#>!r
zu{@*{+b>uKXY}&YkTBed>&6TpTL3ow<3g#lNIE!Nu!q@%G@zCE6dv^b&-H}HKd5Zy
z0`4msxBNH8HX+s!BV@1Q1jJ7i6xQ|I{=Htees%AwQMK%PZ+>jY_A2q6t@MJLZl|N!
zoDe`oJDP?*{*x=@SXNn(J(da8xQ$N-%D}q|WyV@Hfq^KC1#X7I&k<q7ccGBNdFLkV
zzJVSzWQ56BhB28m6<3F}2zMI3f^v%B_4~#m^q)DEZ>h_KA?F;@|Be8fm)|2Z<6`K&
zv8byuQt}qv)F3z~l^lAYRXKnTM{bJE1i{WWXdha<Wq5d*lw$}7dafUv5JvH^JsO$n
zw~41DQ2S7P4{wz_(^TW)<KyAk)_hu~{Ndd(pdX~52M0G<H#evB!bG9B4!Yi0nxWLg
zKTZ{t?z0IG>`^jdDShermmndRcI}@#t-8oXxX&^%nT@^YdUXLRi;?FDB(mzz{fBgK
z1L<I@LUf8_syCfZ31@Xvj{=QqiKXDsz;f?i7-?QH(;BqVbcnEI>d&SMu~|lJuEe9^
z&QuVEd+?wCh=1VTjb5u5^9k`}p?EpD2^q2nGZC*{s}1p*f)Mxto$0;ef3wlbc~1Y_
zir{Te%YFTU2$~<=Ci}Ag0H<0OI@XbMuEiRG^Fc{PjIK?kPl&cSIRvH8U?0Km+hc$&
zWz?o@<fViu=8Nj<RFuU5$7!uFv|VZM+tpf@!IHPf67RhofWvyVoA@Ani58NpwymV=
zSaOB_IUnAEwDT3l7(6jtI89|)p)ZYTQDrfb0b8B=y%tQrp0K}`b$yY>R+s@0`{*SP
zm3!R7`5(O~7!YLyl-403D-;@vnU*d!nGh&`66i%|V$|Ip7fKagGg?jcgBzS3|4n>L
zLVY99q0qW5NU-$A#}p4S1>)$uy`@pSqS_-dWvL^a#YAWi4fGtlWK;Y{cr93yoRCUa
zy_Y^xSsSX@c=Tl<sTi1C0+@RE*Rcp<omPZ#bl^MGiU&|OaDy;<!8dw!l!BP2VpU<C
zwyv8#eEq^|Nc8nTn&b=&@pyEln|AvCP>p0`;V~1=MDYHG)Uex&Z(1k?$%vn0UOJu=
zJgjByJ3o#H+$%oT9#s}P0i_Vw*Hf2iQs;Ako-sHwXi_KV8|A@YXzB0a{Q+w|K??qQ
z`hKj)AHRAPEB~_;8yfSD34f_UCX#>YllL`4A6<=nl%6#Ntn-<K(Hm_-_00&tm`3BY
zq8zO=Iw&{8KFz?t!P{9!=Oi7!kq)BC{t*^-DJ*h?ScXLl`j){d&yoi0QP65q@U5rq
z1?N}qy(N^(j$hr6fQpV(#X=Ww?z)QP7cg8PCK9vJuM5+HpN!|byKl#6UepC-TO}8f
zPlp=n|FZoH*rJbbIQpju;)L)MV&x$Rb-WT24||P_t4_DjXBPrNywi%`lVCX*$b>3z
z!#+(vzN*`X2DjkoN9%YO1~cYV22nt-Q@z=8u()7UqaZPKeMNZ-7FdkKfmND<B2!s7
zs?2Uqe}Gn;jtG>$(QNI=5i@nHj}2yHVmK}lei(sO;)74R#SDrPL5!u6Xd}cBSes5=
z-i62pB|9Y0L|HzGHhA861v*?O>Ql;}S+p8Dp+huApB)`yG42m6eMtXV15Yr?qwBco
zNK9csEO^S^a0xSgyS&t2m=UuT-aqf`OgR6P?zJE&3&%>`aV>!9(pm)6Ad=Lkt;B&6
zT#A>9VP@oemAH~TBw4}E(-C)B@DrC}MQTxX!|?skwu-~(Kz_70w?z-k+@jHmPHluj
zVszE;ol7#^p}N!aoQ39NYHyj*Q8cTlI>N;STW$W);G+JJoBy8Yh;sp2RvrJKR5<X-
z1u-?lm(^%$*+3+ksc}FM3OY=e>S8Xl7KMY7iOMcm9)}bKGzHEcGoOVPC-ww7maY%o
z#TlY@giHwDD79Jd`E@o_4He+>&RB%PPlQm*Z*VCw^Stj6ZzsGEUl|EjCQUh$CnUt4
zij9*y{5kXfmdeXg7Phna)j87YgEo$~MSyxIuA-|&AC_GGoN{&)Pv1BGcmCfK)6!^v
z81_LVRHcGjV10<yB;QPF@;}r2ats+fe3y&3NeIf&_+(kE_;b<Gk_m2<4D<yuNriY^
z)(}~F4g5!7FToFUczA#aX2&VtP@k>Fv<HW##>X-(#X4GraJ3Gid9a<Idq0jK`rB^N
z8E~gAme`g}6vnz`6n^4e?~UPO?P2V-u$t%6+YF&4lwX%Br61&I(N<QBUrpyEzJTpL
z?|gE=bt<ok3^!BUmwfc2PZV;R2v<VNl?sElwy6b%^klRJNc<9S-46%-<>rXWzVLzE
zg)E3HvCd%vLyV?Hr4NHYni8Jc=eq<|Ny6c1()${Bq68^OutXu<5q{z4{a-_$uhZ_O
zI_o`BM_b1HZfn*vC{&_D8sFF=6;nF;o_0B&T#lsg>&-9!M_S(al9X3`;4crhMxkAW
zN}JE2%Np5Ij(Rzw*ii|k^I+xt)QBr-eEV4t$1z)hpl8l>HUr#!q1ImG?Av3H141#$
zYYayfL_3y$DDx7RVH@$@wh%+WJS@yc!i5eQ38hRujM5{#?iKJ8D2?E|d$gM;cJ@5G
z{S-M3(ZMwhGx{X+4bIMeAooG@ff5_~*n?K9B8KMzPi<7g>MB;88JP1&h-DGAnSK#p
zIqlyEV)~(}28h!GC4mAVG?z1L{kObHX<+jSwgseFoay6F!(NUTWUA-g1GaH@=&)@J
z*-MI?J>eWKm`{#Fv`@<J-(xO5-(9YVe<_QtMkSCZej<`i5%*U)sOM8z7{&&A>U}!)
zYkK1SN$g27m%*3o!qMm`{9O-c=(6vzs(dF#T0J2aRaGFpEyq6`M?c;}OxsGHtatVc
z8FGr;rAaGsYQi-~#f&1Er61dgR5X!Ks0fTj-McMz%fsp<4jwpD3#RJ&a10PtVCM-~
zrJ)_BlSGVvi+8)nO)7UHcBzj3@47-A@>kcc{)6=@yp<i>Mn`YMNc1#kx+|q{UIJ^4
zH?eS<yv=zY?`Yc_3XTSo!;;CM3A{n>q{7f7l;V9(r}JN)ZDM<4i}@`zmZEbEwbzUs
z$Qqn;ca;st))0@S<M$8!`gmpn&JFCtP_M4HUIpx-#I&JO3U{dW#Nvl8pD=QNqd<gn
zp*<Dxerl$pzlMQblUG3B07#qXtEt}9ZMt`2avG7u+5w5w+JvoA&i81$H3yhRcps!m
zlp#=&Q+=kbSB{#fqn;(VoUWl+DeTOED7X6DAAX`C`>>_-F*k|_=<uYYlAeowBPx0L
zt(FuNVa0-QS%DdGx&i^C1XiI!V_q@^Up^MA{?dnkomjrV%j7Q4bj0sRN3M*#yg7ns
z@|OWPRIr+JCO5$oJdt_c;_lQU58}NMa|Qxg2je^MB)r|<z7jL<NsQQQvIYuFF02}J
zj#5_-BP-q$ce6}t8*k2#_7RbTs5`eX_E)Hcq>wJq`r@;OaA8kX&n~6j046LiFEmEV
zg$}v_T#XfYN`^E|^#}#$xWr;>llGPI%_X20u<8n^zx)op=#H(u=`2zey#BsoHX}uk
z&XdTe;eMudh920p5ChywHy7WgOEmncmzFLI+2}kQHkg0{J&wNm6CK$7H6fYd2XLnC
z<Ux$eNwPld57&IJFO<(Hq85@Z{l3r4q{)i8m#Y~v#Vqxv>VIcBxpx$aZ0~pc>=ntV
z-B}a?Kq4bT&tMA1@=7ie9DW7Y?K`w-64@Q1aJ8Gzj4BZ=k_-xjb#i^7xzwpU$ckAf
zTOIT><2PajOQ-u2?F!Fw_T>y;z0Tf7S&f@J<9OvO!GaErCSluENZ(+jiDT+4P53-7
z+%bqb+anB#41MT4g^KKL@C}ETG^TwpJbAVij)8tyo=*JV81xfLK~Xu9j-b5qdpb{n
z3RF+LsRTXF+(V|2XV4DQ3%lkEx!I)p_!T~|$p^=i--VeN(sT|idlZ29YX}hcR*M%c
z72I|>;5IR5%My?5t7vN~)t2I_J8LTC;iMhsNmst@v}pTkwfn5hh#DAYMINXfys+fw
zRuZRM+&c>9#oKb`#S3g>tkrypJUDEKfv4I%T6_@r%P6w4d&(K|3xX)BFIrqHuEgw8
zHN_{mKZ+y|)-LF(xYFZ>e@HULf2ZqPCr6rR<7MXwIihFl?f1_D5VQ7n8>Wn&U=2!F
zO_KVPU9lej|6qMrE9+@-q}lrwwqV$Pt`Dc6M2*m8)xI?uM||)X!;62uoy@@DBGrQ4
z7fa>}F^I2~4=crJ8>q@|nQhlmC(7>!wT_h^5*?|n_+C_+pJ^-3jYNaWf>Vm~-p?BC
z15MA&BPJdBKA#P|g%dQH@$b=fhPCp+O(LyZphJ7@vw9|e^991LghNzAmYHol<snnV
z;(6p!?3){ihD-ZU50r&*6!zz5Xl9hmL)&!MWou<b%8$IcMu}78hMIQWa@4!eb2L%j
z2#)Ud#(|+r&V8%9+dVzy6t<R^HaSk>rqU~}0rta;aHNGfL^6)T$_q;UM?mVR*`yoP
zAL!EcsAVWa_a*a+G%8^6!CBQ8<<jI*?-KS@t}<0_VmV4Dq4Y>2Po5l(W~MuQuaBNi
z!5<oVZHOAr1k(9#`7-pd7vNh#aTA)!udy~F?XVtp37`IQCpwl5_(Uxrb=#e4^;J*S
z8nrt|soX#UJK|s}q$zE-n7nzWZ|Qz|gfO=Re6cKIf8iTOV(>z+<~e)QaJwC4b8OpO
zAqxyJ{LoEOHwr;a%6DqYT9dV==h6feydmu;Yv9_u+sk0%BI%33WRfm0r(V5VC*SKw
zCcZbQ%*tcopEqVqBZ=LP(~O;`r`eyq?NDsmdo(3{(eLsCpU$4zN<X$M#tINck)2jZ
ztn1QlNTg}4iE}ggW}mmazZVR8lk&4W<G+0fbFMfEjBx5arqATJ<U|(UCm`_OzAlGG
zu=LUnwUOwyw>{t0^f=o~m<e|B6}?-iYVaD*y4|eQ_UvZr+Jx%NMuDC_ZdPw+DTpnr
zDa|N)+iQtjHsPYFC!^Wa(Svifczr!5)Tf00bNxZrZ1{_t^_gmDx?8NCwO<a|_thDA
z_92Hwh^^*dojDjGWg?XsJQtTb%#C5OA8M)9nw}#?+?2{YN2OOB4ziDWVYU1WyD;!c
z9O0@IRc8u&Z};|j({8yE;HKDE%~_Rq{y4)IC*s{2%~+*6-?aHQz**`Z8BRnTQcNif
zV8|F9jPp?pjrn8!UYY%2VkPlWR3ajN4!#)YR0vUw6)cdY;iX(X7p~2Y_qO{>2rX+p
z582BLo-+0X>62%sJT&c6JmpA^?nHlYu7~2Lj`ZWzuYPoM+lLt|j>A;9;~-fXBG0U)
z&}C2I2t6F-xjvi4(0Pv6bGOU~mCrd%ztD4h#LWp@=3ar`!>=A=+waS3x2JK5l?*?S
zN;<~lDLQ5*l*SWJOc`PLa7dAOBO7)fstPUz94C1nl5@I}F1jXx@_%%lQ9psQE{;Z(
zyG!*`g+$ZF4a8Xl9)%n?Kuj;!qw9Yx<_3&BeGWitx2xtCM|-N+l|(0gWM+f(S5Qe;
zM??IFL!?1k_&x|;`MDQej{vT&UlBOtt$BQ@dD4#GMf|P{nh&Ecf@cgoS7Lz$(?rs5
zzOG$uC<eF>%kretwt=ZfJ4FfY0FviP2mxHyZZkRQU)Xe3MtVObO&TCOS$Xn&U0-|m
znH#`SexRmTG_V1ATuH4r3*R4Dp01Zs=fmG+LizY|&s%&+-N9L-wtteed20&(mDTom
zul1TNeM84gkPR5gkzug^+~|AiP#`=$_?qsgBWG>@)#MJN1|2O<W_xU@G-0XDiRsZE
z62qAEg)!lmjY76QtF!pOtTVwjw^x6DG1DaWAh(?%TQNGDMw7`~q;Jc!+}N?YbB#1B
zPmF_BV7@Kfo!8Cqr-oPDCV}vV6aj@0$2+Bz>RN5%G*xLGEH(fZMh1g2MCqjKY~!p_
zo)_l^yx20=3-Rd<%CnBIFT9925A&TcieLKB{Oci?8WT-V>eY^D)`+c0fhg+!<2u*5
zVO6ckOERYtkr$=l{VHMR0&~!ms}Sze*(Q?Bdh1((JMEAB2{<dz_yyIQi!uvFR|IfD
zI5(a--2|M^n7ZW2QXXS)FH;A%MyT-m>1rtMOmXL&sl>e23FDe*T=4rcDW^(s^WmSa
zvZ-`_lww&_?CC|$-yD}ugFyRra-gM~{xMGrE~LJ3YoZ)g+%tK$U#c9t_L>5H6=>}O
z4>N!@OBukX0D{I(8Inj=)dh+dL85t%YqI>_r=`ut;Bcj*CJ7`eh11|yThy20hnP&2
zpu6APO$b6kZ<doRas$s8yjD;{Rhq3~evEMjr~`eUSOR4HK|GS7n)A7N;(M;-fH!CG
zwtXfiNNMfd*7`?2DOnv>lSZ)QP?P@Vp)j}E(rT=75E}i>#%NxVlHx>JuQan}sC8D&
z2F%R!!_MUG%XuPRm<wB0<gI_dSrSq)AO-2@cNw?s=idN(j+=R+jjD)+vFT5a+iZkC
z&W3;N!G?xx9dy8>$L|?g^?ZoVO)mOw8rTn)OAlWykrsoHZ0)#$^*88O41<;+VplN`
z;c1}kge+=?faktFktVYwA*(|sxsqm~l$sR<n_x($c_iDY|Ab?TZjQ*+H8$2^Wl!OZ
zDf2_nX>?2>A!<puz`f~Y4myUZy*|bHVm1-&CsJ{x-K@WP(*_o^(LEbM3z`?@06s4L
z{^Os|MR}_osx)7p(Wi&gHa^$vIF>uR93}s7c{<cT>O8g^UrDQV&z_WAZ@eCs$-*`I
zz7%&tj95B-B6sQHYH`K!MwjE{Sl52W(-)#|DS&+{Hwo9yGZLRhS;L<_xM3{OiA$6Z
zt9F2HSgx6j04#Zd=R4T|&+bOW9*(`?sJ}_VsSYLkf4XwVX=KbQ4&!TJ<kNq1D0wxW
zc7V}DIg?$Rbe7AJ@|*`JGRT$LqI=8_kKU;@8Ojlfehhe6$Mvwg|KtdbPzN(Mh^&7&
z_=%+Gs%*75t+Th^)d3vAae8P8fynF|;C2t{{)ptZI|UgTBXxY2p9mH~LVjnId4gLF
z`NH~-h}kP*oa0|l^k%IavU0_7yjvgIt_!0YOzKAbH4zvY!}@bexEGw~hsYUH$KsTC
zCy5%>5PB~>y2i7bri*)<Rlrj2htuHouhGAlNS%rxNl+FOZcU8Vt1UF%me-gi@cpzD
zV|6>|m-LZ4HG?9=&XeN2Cd(*4uaDxqUfFA=T3c8a)1_06!%UZKgh0m^HjY=wBj*tF
z-I<U09sA5BXo1Gwo(-uNTGhfgj?4({d+*04G}Q4IxpxB?@fo9sDou^SgI|M&M&%;P
zQK6AN0U1VvQJ^9Hv<$Ay=rJt&(NcxKkw|(dAH~Y?81{|You<=~TcdQ_yVjo5QuLx&
zcq;dAr0ca7WlWv)iHy@0p~@2(Wf5t_vi2#Kh*ak<b!Q1b1-PsT<2rdoX3aXkPuO+i
z$dF&?6bsHt=`%)7YC2BsNuwt^z2J}R1hEwLk`zN3@%r@H>C7^Nze(@3REcZ{n)S^K
zo1%V;Nc0|tA2TTvFQ21rxs}$^!G)d4Y|o2rc#Nzfam!Zbc18kuLQ35Hdg0?~|Ig7-
zPWfXaRIhw(ME<rQ87>kfo!RKYHSHe*(-3dg)qP;o4%+eJsRDuLjw#1u5(Poy@mu{p
zv5OYg(o?<jMjLp&>#e38954!F5{-x_;wA-y5K2MUD}s@dA4-S#{tp`LFmJhqghIZ|
z2RMzM5VCx#-_x+Y@G=-5{a;_^a*p)_+nfo`b6hSSgSs!c+2_i{v~kz&Tq~7Q3in@r
zTz|ULAbhSWLC(kVZYYcICs0W%JDD=XkE^hZ^3tfi7T4&sP@?LPK2~`FRTBXS&@4n*
zFu~jP7Xq*|6{Hi>#RXM!19{D}7CGNCQhgRB%9wg#MZ!hKI6BYiHFF0yUGC>}?mZ9U
z)NO02BUSd%s{~*adS<4kl{=IUCJi<A0^iQ?u}^zaHpoIhIjnfd_&Nq`p9MB@ToizA
z4#$r2G<c(gcxynWR~<&D%WgPlek?0pwCZF93O-FLlTj=6bAp%8*)1%L?%|u@y)<K6
z&|;iMcY||<VGwIAO+A`48O^;B1sr+X)*b?9fppNR;Pw<0KHB)iEzVKmT=|Y#7+1a%
zG1DZH!PhOJz@$5+$i^|$TsB8k3gmSzqU=!s$70swc-<k9z_l^m@h^`aq#)w6Q1AG%
zFkeo{qI7l<fRs-dc#aA#+KI^4lgucQUxLsCMwosyiO|3F+y)UBv!I9VuP0Xq(h6ZI
zmI2SDBHQbzED4yklMQgEd~Pt`hA?{Hc_2}(Ng)qmG}0kb)q+_&-Jf*dS!H=<&Q|R^
z)FU)$%ibm6qHXrlGP3`Axq~%k!<&Tctb}#(U}pr!OQ-jL7&ctbodMhCc^2+$Fhy}&
zSZ7Z2mL-=w6pyxKjFan&QQ&-Et85gP9TBLWCq_}C5*%g9qO?n96^lO6O)AG-cUCy&
z?E}3PWslpNVAgVVv+OiZZC4f;*An;=YQ#~y{iyGBHRYJP{XG;B+Pv*J+gk5(G^$RE
zG^#+Iz&dZiO4XW#oLbAhGRKREG?CB)n^{6q_4<=gB(!m`v;Saj%gf~&{_&y%O=I1$
zhzK+?JBBVD7ajlC4|je^r62Xhci?K(rmquGCTDBzyHxf>H9q?9YHAxL3pxeI#|OEJ
zEtykPPvVB&?;pf=PetSfsmh<*VIe!)>Kn>`6dQQHO`epuKrGfZ=c?qJ$mx`+&s#qn
zIgy01K6GDz-Wz}4)ajc@U@SOdnWjA!JIqM4?>9_1_!U387wJ%4VT4?&Lx6@371PH(
z0pp$jq8<5r!bLHUBRZc}L%XN|qrNdDG&!`ePic>D^<>%Z;beRYn<QeQ8|<i~XRr;Q
z43aG7;{x_M;VGlpr{t;jey4BmZfyEMPzrc78#Uqz5yYmq0sEUSdc07@Qcfc1Fk+?3
z)Y`|i7ka?{-W@`u4D2`Cgg~}Z!B?(xZG?AGG72b+h#ZJtM9j{bIt8UN1%)2eq)7(e
zZvuG7_7VUc;wTq{H>K1VV?vY4I8uP`3l6!@be6c)dl=Ft8ydy~Z8WKI8LzI>eh{h1
zt~79?eTHCDnA*THO57*ry9j|N@|?Xl(p+mB>Kb?b7YrrAG(*`tr^D@!-G(0TI4gsN
z8yz;{^*rq*&+<9|ZA^^TDXO7<Ocf&4=dEFO-~GNGb2!U;X02Nug!xR5{_cR8Q9fXq
zSsl(YJVP4L;vB5ngzc%oJScZAlk`aDoDM#FBnA!G%}jBk!)jepTu&0!119!;g2_?|
zwDFF9y+29)Q>?4(d<h!~vHYE&w5uQ~9P8xqZpYBMq=-9i?n~ju18+0~U-NvK677nS
zwUUm58pEjvCNS>>FGg^q&j=L?ScLAF=moBSqk7!jb;0{T_Ub5GHJSjpsqN2%hF}cy
z0O9s%XuUA-;n=4gse4E8K6Ip*{x6vFr|+WSe7t}I>pMS6RBkaCY*>!N%K<(!>lDbV
zu}6=?aUwHQ{^c%ftFa}f^I?9T?HwJ4M(boOA24Oss)GiC&GHpjV_^sV6nv9{!*(DC
zEeer*S<eCJVY(qRE}E{ENS7re)l(qbCrZPJxvoNE$&K9&T(X{QR(I5|O_S&tuO)^}
zQ6ryqwa=#aPSCdE-2*AGWDGtYUb_#dHcgZ0f8<Twt8m%t0xjN~z<)77DBcAGe&tdO
zHzb=b*g|W1Bl7ulJU7;g8=N&Bg8Ax4w9}6sO>rRPsT;s(f}b-{cA*{R;C-j4MADVV
zn6!DgK!*YKk)%5qU{(v7oKjr)T3lhio{x*;P)c8<4ap+e@&PR(VszW|=2|mINZeHc
zXU-lM!6LwVBjVhWrR0UFUy@lztw$%eBDKF6Sejuk>;+@3;*G0EviTtgU%w0JwrThp
zmHNYEuPm^qz6kONN=YxOuySnPibQPgnnWPqcu`vkn<KcUd7|!Yg*&^P;-{z6=W(U?
zSw;uW@_9<`#0#4-<(6yxhTMt;D<^T@jcN6w*O(1OHt*ATpzlbEk5eBWzZr%Nm1~c@
z9N#z3610vWr=iIN&KIjEZ>4CsL=GaiPlruvs~mYF*VADC&UM-QnUN~WS$iyxtiLMj
zIH*|&HfE4S74RqKEME_+)TO8pZP(IZ8mC>=(;yMwAVFnJRLbM4?Nez#h8JP99MyY?
zVL<goFKx5BB4-$Aj1PiC521FF$>Q}3yWX}j6Gn#troYx!plzHvr(?KO=pI<H+fKrD
zb;{^`SiD%Lmb-OnM?o%IEJRL!1@dtQ9qaTVsNU7Rz?+>X#m5@>hM{kbpq}y9i~yk#
z0AyU9KNl8gs>XUzyUIaY5&gMZzIkVF%V`T3+ST?-E^`^$U+*lmF5s@OIegH~5S!8i
z#5ZBCxnT8Dhkj#@%tBP^OsPJdfIq*{kCDAto``7TR}razlV>goMrIiIe;h@-ia+as
zIl~aB_Ie3VF&#R(dvy}%S^iVMqEkhniTqWdr_-knvhQ|qm7SI`ZI}}~GI~StVb*Rh
z9OT2H5nN)RSO_S3XdT#o8FB>?Kp|1!${2VYvptfqVWLdqgrjlATRR%Cf4ONakU0zj
z@UTtFAUexhNHytd7xu1^PMbEbSS^QI55)&I1g;o?on1Bn%C@^9X%7DCWR{N0vMbH}
zXZHbaiOXD<vBg}TL$ht1q*JfTsQjlrj{5ggJE)8ej^v?6x=&ohe9x_;IG&A_M_`wE
z7Ixr9S6JS3Wy-~jXsY%44`fg)E1DZ$V4usz+bwt116E**dv{Kk*BuyGx5`Sueu&NY
zkWpJr=l-mc_fpL{sCM7vez>mxG7Y(+q?9^{tBlhtrfBlZeCa&>E4AICy@k;b;AgB_
zAUMrP!TyMW+dvFn@E2E(UVK~b@#<8PUc*_wm>=a!DNT+cC|6-TU$3!Ut$u6-XzPmK
zW^MDnQg{Dz<;Ja3rD`8-T^$^Kx=1K4)wg~*atZDqw+P|v^A?UedD<F$6PjWT0>~1s
z;^6`?Y$4XtnDT2PFdiWg(aP^FV!z$<h?<-DI$YcH;&HneB8dsm4{^Etbgq`Pq?gnx
zI*)gKiQMDpcRZL!<C>&Z9>CeoarPQ8!k|<0SiuWvV9B*TApCW;?I=Gm?@;*k3Ng)Z
zV_}IM_b}e?{H^@Yr$IZms<c)~3aQY~-<yXGQsH_B()IxRYz;0F(6|&^%&K9?xU#M2
zG5{FVL+aIzb9{-m7?)IhNHQ$ItNM)n^_h?e(jkroRY;%6$}0uK9hLTuyh(8~QX7Vw
zs{j<SN0M%tdS>vAo38!~zK!VIXB%Ezu6L>TSIBRCr_H>glW`)~hGFodf4rJt@3WEz
zL5qjry#w|Nu2Q2+ID}1qFSqkXfUP-2u?R!xFE*MC$M*_^?1tiZ?MF*D?zm4;E8q^v
ziG#|cyABNW4&y>ebuvJd&|9|9`dbAx%5&(4?hXH}3k7V*$NoY>5*M9sKgIJIbHSy*
z95sSq91XhrRYB{4Q4Ubh=fWQ8d>pwyPV;h_CX^=qZp5o<Bsp9M>_<M>Rv86r`xYqx
zcI`I~QtMX4^K{IV%0ziMy9S#bM&!u=#Ll^;%SE-0I?erU_u1XTlch)I+Pavw8v|`#
zPstwgab-uT$I9(bQ?d55nXNE0@rB$fIlHe-<KWY=;uXd#k2)LTJ8=4UenZPhdFsUZ
z67}}s1=X_;IpvlsAfUgmuHWHaRk@XIFwa$@!iln{ep88+d2MOU&4~J%9IE=+38`Ar
zsf(aSVq`R|8ooSP=Q*ZKx`Z8|7__+B86xy+040<`L?DOXUlf7-bO)-DCsai&ANr=F
z1cF(qO0MmY6!H@)Hm1P`y^Y&?&VRFYx4-)ddZmT2@$o7QmbEQH402wGxtN%FX&!f7
zQ)cyY{5<NZa_Y!AG~2HKyw1P`qS!;#@;@&pG=@en`;h!1f(f!oLc&9-we&@kN`HpK
zB+WFalb`^pB*d)37n_VikwYtnx8<2jKZi19hoDm=UXxNJBEGZ38diYw^<#w@-N7z~
z!n9h9Vt1Wy0*rKP?3Oy@&}M_AzpOUU;`DS@>_w;cAl?gklGKr{ii<)8`%1@_iiA%6
zIc(JNb#toa&;7*}Xk)D3IfLu9ge7x{Bg$biJRSYYvT}6M(W$>=1q$p{_38%WsPwz_
z&;9CbZVIq4*1x*e(k#PK@)zQjNPrZw9DN1t0AE|B^z+I3qb{y`LudpeIv<!!O}{T7
z;-@jCAveAT%0v<9_U0T#IDroRQ5@&eOs$NL?mp^JW)}blcVlD!z93EFercnYa5tk~
z^0|`ll%`cnIHcHKIK|c$J~6GRo?RzQF?lzZlrr(PIf(zXN`X5Z4C1WV3$Lm$?XS`3
zOs9@l3tTXxPgFpK*pJ_m+bt2%_)<P~$?bfoDUK1>(lt;_X49VizGV+oYd@f|tQbFy
zLJcYc-MmXzxTem5udF+5Jv-)unTwsjSdI;^4}bDBG>ZbgUf*0)BNPX>(ocvir|+Ec
zJ-+B3PlI?DUSM_tn<olh+H**XwdRIqL5z7KeEv_NUlO_I+lFL#pJEouO_vrCV@$s8
zTWGN)uy-=*n88gVM^n3^F<zR8H2A=pM1NmRE`;js=~UeR)!_miola6FBMEKu<=bEH
zex1R99bK-2m<>c9Bf>xg$sAFT>mZ;-DFEFaMUd!qG-&R3tyVtp1vMJBqn2~1lU4g1
z5wCzI29wWj@7LcXN;3K^UY1dbEblM6{&Y3@Ux?c22ZzcR`&?CgO(TXr3ZbsdG&tEX
zc?0RUpV@nJ-znNaY9E?^(HNgsP=oPY?^z!;2-i`@{uo1MO`XJLk^FnJFEQNk_5rAY
zutMqjop$S%8Uj@;YM0iROt1DO^h|!W`IaYgyTvLf&cHTk&X%85J9><;7&Q6mtFBot
z@GNLF!_iz(?&0qwR>XN6oRFr&sBPbgc~X8OnIR8JWqB1T5f@;}d~7loPQDNl*4S!s
z%}dy5AJFt-6#|;(Qf~(MM>dGq*<Dq8f;E?iNhee<+HqU1u|G(;vz<_X?St(QtQ*=T
zPIhN9gJw$G0m@%`^uTm^53R0PAeNd~X02DKkPxsK*<tYqtyvU94+r2tVhK)y>^C{2
zR{?|gd5@SW6WaFo=nBz7TXUAV@k-|q#FU)Q%aQN_HXcU?vTT3O8U@ekdTsb0tSkue
zKG3gCn-q34%d;x_KOtk^0&ZSctXn~3oRym!{J$)3n8A8H&<OJTbqXrRa6hqJ4vR*K
zyprmi+=8jy6t2SR*7jSaqE&F|X4b-ipc*zx(+y7Q?;>I?=O~o+>Ty-i;9LsJyDHLB
zLcetpZb46`x$31gSEf?vBcLw?FHifv2skJYIx3LMCz~Oh#Es_R@mgqK;@x}My?kf8
zO|~4z>uKh@-k^E{%us;rzZ_z#oa0|?6vOlC?;C8HGdfd(z;_!XD`EXkTe5q5aNAQt
zELAG|AviKTpX}yF+rJ-%!a44mj~YHAzAqBY;EX^QpzBTTk%T73p1@K?gKg#gh)sde
zOR7SHt45;;Q;#H}ZV@dq@{*1i_3ug-)q}xw`dbwY5a^Reg1JI@y^hCu#Ndaa=#fB8
z+M2I@?CC1)luv>$zUtS)E2PZw)3ID&d@V*?t-B-cE`t-rAxI^y2}gL9x`bg&o3(8I
z!4<j8nOz)R;xmmQgIq&&taIGFp_3ccC9-k(iWtRBb6*rFdBP_#d8l!aTR51Cj4QRd
z)u0DteRS2%NV@DT*>hx>d5=_6AT>^5tXHO6WX9qt<FEsmtFU^MCR(@_BO}M_+ugE1
z%t403;^#sjrV_saEo0gqfKIcog9=fQ*Pszj=e%k#czY%smpuH}WI0U#Fi>l}gE6<+
zMt5}`3t33HKY|>;8M0jZ6E;-5c$fmc2w$G6Y6HMTR3{s2h4{_~r)5tWM!F9qb3X^j
zCod$4ykhBsSSD7KVy!!i#OmC$I?Nhq>h<t!r+dT5dep;Y1qB3KJ{+Sh)kQ7984*a-
zgr$ds#Auiti69%vKSDEUBkhZ_kwXtVVn$CBs3#@<ea?b3#jO4-O+XO3fm|XcEe`Up
zCZsVUp)S5}VF`wNS>Y~i_gZ;qpCiVa&iri`%|~sn4^zDKg_hpv*R=c%G+;0~FtWHF
z?sdp}`ibWS(~VeQqC|Y$)~ySCl;v2W4n-ySeNsY~Y?u|=$04So9sD;R{5%5Nn7;AF
zRY-Eyo}T<d`fVqfm(QnoUYr$aEPbc9COW6%bJ>9=BNLWBrNag$Zo8^PA6W@)t5g06
zp1j0_5=e|hyWkO~zu8JV8cXQvS4Sm%pxIm!K{HL?Bu9I{{Bj!3J*O+y<Gqnxx&?*u
z&C$>wn)qeLJLGh!9@l0hx=}0dtLF5>)Q1LD%wWn+-;&P^0<FBV+^Ap9Y-1W(P{9-I
zed{y|e|~x+l5iMmITjfd?>yz_j-Ik5SiI%uB0D=9U8&L5r<dEi_DiaARKTX<XzM7I
zO+G>S0$W5vh;dZ`%Z}&dp@Q8cU$Pb+CQP9v$RdPG-Nav!;~`eAkY+tsxW87oA|U+G
z6S9S}d8_8N9?|1`3=gD&MhJgcYV%B}QZU>&?5$P1<Jg!fp;?G4Of&Xbp`H+lZld*L
z)RM1Z)+C!_$&qDY_8r}b4~zl^eOjc59w?0q+G;o{dI5HAQE7L>?$iO}n>HT>s#7t<
zSFL=G1({uMW%Ug0QlHC5xzxCRcnjYdxKuMGlIUuFaXN7$oMR-^UE*W_6-S~jln{b}
z1;^MVUWSuMfN&25;3gFGUue*Y@k-HzHo?`Q8}-Mhjc$!IZUVEV1jvOhnL>8Not;}D
zeC0SI`l)(-l}@s6OFA?^Jy84;>XZ>gqFsCvdc5mVR8REQtr52bYIt|J7!pujuC`fj
zA$G<M$0a!sMMoCo%11uWH=9o=rGZ;Z)eX+~s?-A<Q0ioJ^@E^Mr1g?|Yq#_JG1%po
z*R+P)3`dTgiaQS1LxM~b#U5I#8ZDBdM|JL5e|@2P@g(zZ;ONapkzYywjn(ha)||29
zn+P)2P+!yQF9LSikvLpN>z|m^u4Ye26abiiXwZDa1<_>+hJYpi9UJOo<YS&gR<nl@
zlKO|^ar{Tr@)Bg3L>)}aT`zITHV*q$UwBkB%QigDWC*xDTDLEUj6HyWej7N!4hcz!
zpArVCb4ODSjqn{`V~yatrx0>slxgrxpEdXN;2mit`}fj>z_4=%f!|FPhR?F?$mSoq
z#XRL7SMDwHN<fYKyrZ{%`e#7f`=(4;;w<I*6-1ED!N=*<!V#OHJ1D`lMG9u38U_0r
zn8|L&c+|SQXgJr9GjaO+_EWchyNdVao(uCpYfE~4s=J^@#>V3Seoa&_nIF9b3jz|z
z=dHR-wN-}ANScbCaB+V=0e~GdHl93;(6}zopcQ9^AKc}zQ87rkK|f&z%78zIJr;D>
z5fWxo8()V%h4kx@yM^wB-P@j3k<zPTqtw}<-v9I->OS1{w${vqTrvQGux3*|!6}<x
zV0cLF7TS%=#cdvgDmpBJ6s*i8I~fz$6YErS%ZLbT>j7l%6eWI*O<>_cu)f83`oBZv
zi@FBmw~U~`q}QC@FQ*2%p)d{OPS)uK)#eD<$|WlhsVbFd?}xv(ss?0NC$K4(&{qv2
z8lyiMRe#U&hAD>kTXyc!9*RupO3BYUl@JV{!@D(?3KWX@W<lGkE;}-~yl)<7vQIge
z_7?D9ztdHn$B_**Vi9))b7(IRf#~rys&~ybc1DCW>aX8xH2eBf#~(Mg#@T5dldvL^
zfLc$%hvkS?ms?E^b_*uI<|f58E<=lqv-2lW0u+nD-TM$wO@}!$ked$G7rgP-5m@aS
zk#su{D6fH4`{LhKxFfBs2YpIp$n#bosKO{9g=T3?Dkzz!bEbDU!%V<^iEO7G>?Q+1
zn%w;(owgE+Dz?9q^Hzw${S@I#M)9<|X~Z%UiS2(_H|G@156_LcSQcL5Y;XJ+{ozhW
zD)3xa#<^Np#8?+o66TwY#)PlTS@qmtMGvZT?S`_n&|B_AUgsgtitKwatkHL$bt4xL
zNsw=ZIj+MVKW8v0?8@JhWws#G4j@MTkJo{Ssj2>9V)i3fQf(?*eo9mS#j~Fg`Qlau
zEG(L<7WkJYzdK4ygvd`YpYNu`%DlpTJ`0`X+Xt^L+16mIK|mdC*d8X9!DX6vgN_a?
zM(PYXG`{k^*?tkr)Z*ACdM{Za&ZK{`Q_BqL2rqXBOG!J10O3p~%*Q!F{yVQIp3tF~
z3)MCYy~48jlmxXZrRG`j(PvRYlAt37J3n@$<#&MZ>j`!SH)L~_Pw(a`gGlFEK%$je
zp$PPYd`B6;#yz68<~@ftaH*}GF0KHs&bRqFxs#ay8qUsnQU^*b^nx1ke)>uQp8$gc
z9NmSV3Glr*=be^Zf<RLt!DZW@e6{e_ly_$h(Ij@l32kd^QOomL#SSSt@a%1?XP&gn
zaE)S9WQ(FL)~3BEp;shTYp6|GWfEwGQ(Fp!=<}1WYq@1L+>?b?sp+APFKqo9#T>Wj
zFhr!I@ZUo_rFaCI+;4Pmqp8c;{JV=`Xeao@Lg2p(Z@!k;`EC+>(pF6EKC`Yqn?NeQ
zUqT`cG^GzZ=A#G@9K-Xu098Waxf9+LGa9hDCwZ;c7RBWY8z@3*Vw{XCK_)3wN<sei
zVF==(8G&Fvqc9f=k1|^$mGpW9d36P>@Wqu<JlA%TAH2i}p2i-e)2bbH{Y(hV=$a=L
zi028UghYEI><uJhU{%TPZ1}U*b$%K;b~y)(%h>s?soV9zv-Ch9pGuEYK|3|q?|NNP
z9;d{1K`%CY5hD1}ectXV({_E)Hh%0wwOW>|2EGkUp{!d@s+J$;njJp31{a?MaMC+k
zq%3v(avsK{d4`9LR|IwB7zKQ;re>0DPjUK)7E_Z-ojG=sz*V{?fegJU6~-wipv292
zF1MD~t_16J*jf1F?!J?mpZc2`oJwN@)N$E~AM?WNk9Y4v-pNXcYP>59=4?b06$a0)
z`G!t2vgjCjuK98KfVi%_?UeKduEQx(;e&2paqXb*$A78=ANT(h;Z^!KFK;3dToqrJ
zADLiu7{+(q(2X|q2OeFMJ=p=~H}LwWF9W2KjgpsOO_i+3eOQyYXg4D8TTp`%$Z(kn
z;Q8YPmB@m)p;UjGXLTE6$dZ{pUw)>Brgw`LLB!lIUfPxoBK~s~O_yaijQ{E3u0x^#
zO=j8udp5cZJgm&*pBg=jO@VQS;jmOfUk6op`bmX3bgI03lYS!9X^RDYt0`%J6uPe0
z5wC^2=gm(n9VHZhdQa*dPe}ASuLTKGuGpA@oG?3YKu*W2Zjl%=GQr+pqqeGHEbLVO
zz3Vdu2k)}1vgrv!@KKJpSJjIK{Mb7Hhx7c0<t|6mPVl*rXYNcU_j=K|F2C&sZIsQX
zxV%l4C$j(dCZ{#U+Rk5bY<^5yzNX&6S-Le|ZtLGxwPB5WM1MYK?xzFW9b6kY?zH5I
zBARIr)pUy%F@bfU_Zk;ZQ3eYbIcWIRl?mF(0;iUR!I+&KZ-!|(tO65?-GCtT<R!@?
zPr<aTK5=LkBp6Yut!5-lXvu~!GKBp=HYgU1CkAxXFTWpM@r3t%`X2gtcABQC{$A6P
z?`CH=8-+{kMtUBN7Jg0+X1XZ<n(+qAO9Zrn($iJAbeK~G@=-^VO9UwAEpiW_$Rbs&
zCW?hdGhJ?LzFL}l>1RV%Z0}{HX)BTdSH^ZUyIOxBpJ^7#H?o+wHeDfne(S9G^`raI
zjT=QhU1az0whl&Z!c71(Mg7Cly}i-o8GF@fJFRwGzDp0DxGMFlb^FyEB{reK_Vq8D
zpVm><hvSO;wjI<;Xh74`#61q%-IInj3~_i0K(rs4Ote**<T&m8#yEpe2}(u|&o-yu
zT|{&BEq<yCpMttnZLw~$)@;}NJk{oTcH6CbLfhW#IFHNveqiOi4t4Pdp+iiWORj3e
zyDr36Rx3!;XY)ybo+Co>^m}91#$@(%R_GO~do8#@v$yF*Apd*jUd+MN%Ma^%fkchf
z{4s4!>5~0V9dcF1>ypAbU|q%ac&j&&HK&ZT5!#Ol^|OT25x=_K6>QQ<7K)$fgOuq(
za-w+T-@Q99M}>V!Gr~hcbA)VgdX%4$O)U@^Pqk-8VZ;&e&|VyvnRXWx#X>Tg{){>*
zWRg$!FG)kLlmHpYqrOMq`LHuYq>N{bXT8dm`5$7>M6n5s_rCA5thd5L@(T$%Ji1UK
z2f4}^n?kK*%69;5Yv*qVX0ys-i;q`zl<eK~iA3Na0iAIM<(16B@J8u1<2rwKa1T;x
zK7b5()QT-rIy8o5(CTX?k`F>ag!^huavxsj`!eTvEV4B2d|tfA;#e|tVO(CgL~h}8
zkUD#`<}IuRz};LsvRiUq>5^v3S$UcuvGeYi81Zw*?R=Sc@^c#WBX}K%P3`fEqY-XY
ziz#5r5>_McG1h6wXtFpfOz<Mjhw4n7%GA729okp7Jv&A{#FjS^448E1FkfX@ZZM6y
zHo5YW>a)W!R<f5REtxBWQ)`pvBnx9@Gb?Oz-7{K-K*@;haruY@8zkT)8dO6}R;m_O
z4q9wysj`vhGIKGoRLn_*q@8nGwF=%BJnsJ^5JHF&z8KRPY$c#rD-ASymsegxA3=Rj
z3Jgs8I$^hMIB?O(df$QvE&KBeHB7+h5YZ8cYGbuOS$&8qn%tY$ia5x%cqFQGn#8zm
z(tNw|q71P^f){$gIQ3#ZKz{kdom5t*fCWv!na4a_I5ot9sY}K^zwILXAT)1(o#l0G
ztgRzA;{&Ee(<TNM3Z6OLc?HM?>qauCKd9)*@+G(0uY^4XPFDK3FPFTrK#*7%uA(~$
zh47R~OqWhv`e)ceh1J9bnhZP54>dESLb(*nrG72{SzzQ-wwn)szx4;fR5uny1xICM
z^Og-6JQ7!<Z+ddp@5uX51KkW@MQnmz(i6d<;Q-zrI`({OPb~2WXY=1IE8Ld@ne_`;
zu|7Mo28~^XUq!eMIu^<PduNHZKR|-%o?|p;E{weKTsynO$*-14@4)K2(4@ez=x_ET
zMmV*h!b7Ono0;hbfl6IPbb#kHrRC>|3dL6>s(M8^A3Tsw(*X+;M<otEtMLIhm_`7A
z_4U=d5Pg`P-Spt<QU?K%YjsD=r^3O|x?|ZNCIPD(N3l=e!`;nTyNxxNr~Dw+;~HGg
zpz)B4+Er{h>8K4iL2*o6i2sGBjRQpQ$9=|>a-2RDr1ykKpwf^tszvuv@+;w2Qg;E<
z0Ml&O6`ODWrb=NjKgg}}2=GQW_g)%oTH}~E<s5to8o{)Lr_wfgr!Md~`+Uag2sMQ9
zlL&xiXN+7M=IiLydWsB4755LuHb(qoipazM-3x+18Byfjk19tkF#bNeirLM`V6BN2
zVX$D$ZC0Vf!qI7xKa<UpGdfG3%B8>Y&(!VsJom+m$KTWda|iZ+M7Gd>BHJJ&DuF8^
z^ay$DJsn!3&S#oO=7dPyG9~sAmlc1BpX{Anny<W<TB+16BG+gL$9(#^)=iKW6)~&b
zRtS%;tsi0nh2IxwMI$yxOV`3WnE0<hVW$4lckAad4G+9@jwO^c68A0!xh)|@0HUu#
zUBj-5hA;-P2h;FxDRKUtUkrK-;`iZ=dIZqpEj`Eu7({lVhnr}Pf>L&SG0(X6;i(RC
z3E#S?LSPwH)(c%EVm^TMd+jX|Nl)dsy$I482AD<k$D%zt&Ry~{VpQ%B5ShPzrouvu
zfXx)26DscJdtD$6MrHBR|6`LNMjq`NdbQ0N&)U@z*f8APdj+{Ppf#LcheNOf#|oy=
z!N-$zdh+UAfrD}oDhZM5V4WcNk#1p$IS+3e3hDbA_6x&)gY<&qi};PCBNDY-BI)SS
zErw{%SBIf{$qd#saK>XlhD>URc$Q-2CK^=eXPfYwF^<Yot7RyzYp}v6(cR5ST{<j8
zBnJLsh!FSN9`W1FTkLO6Nbec0EFRA1|Hs!?Fx0g)*#-+1+zIXu2?Po55Zr>hyTds+
z!GpU5cS(@oF2P-cySux+&6SzC_nUb?;PlyDUDaK^YSn6479AEFX*mkOKsdFL?6(}8
zM8Hcri6_A%+vp#BcBf9rhUtG=|9I~(u5Ap4r&wOX=Z^IA?eJ)vA3DPmqDc~Pa7%4U
ziY7GM#eanoS@WTpcNIQ&h3&ZA|9+`C18=2TL_r?Z*5m)OPRhR}y}smQ*$PqjYi->u
z1FhiC-#b`2f=|zA^jE36VY}hGL%F<I(pgGbT0rS$v46U<1AHO}Rd8)5$GeeUmp6rE
zc(W$ToW|R=_A(32(CC@|e(uDhr51w7U%MPQb@iaUiF8-|1d$svA^WI@sZ>r0kq7$m
zlCY!+Ao7D=Z|+<GRa@_s*W0{F!5hf|2xg=-Gb`)DF9v$wnCq;xnk>VN?zOC4OmoTT
zhBGBiw9-$GX`rR&p_h76;dkn9-*w*k<xhYzF38LdoH1Yt6jOTSycqEXW=Z5w0BVoK
z8HluYGfCm;rurcetuw2wS_T#WVUzL2Ka!o5(lbxHZ1dNRQ+0e0jlIP+KPBYck2myt
zQDphyqTu4-65~=MALju60+<2RqV_lJa2qHP)V0Myu=ImOkN_G6=dS_NY74Hir=^th
z&y7=K7b}gQghi=;8L9C|3ZbsQT8CJNT>nMDjLTmZUzpvEF@i(?XE{2CWVtP&34HXn
zA0_F&TZj=06I1#m@sEIZ>L5RnAB(8UQU3U7A`PmR_)_p{pvXv0(EwwF7#PwwlsxPk
zVcw@vzu%nwQjz3;rd;r6SafWl=rC!PnR-bu{9?MEdmJ>(+dn@t!1q!yJ#)~&dPjcu
z+3|oDq9P2zU8bCrSYhDI0g_?Rdkwr^zkX{-aANF?%MAMih*&@S&hws_KkW>NVy_|p
zHBvyhB2ivJXl?F@)blUOm=lidc+y<f;pTS#`p*vDs(2kYr0LA*tmz!--07{;b#0*b
zy7rq@<Ia@-94bUc>8`ksiANIXs}DZ6v4f+z${b`^N_vfHEuJ=Ul!IN=T;$cit}NUn
z6%Yfm0eOKUK<OZ0NkGG(r7bS;6kOsH0{tevg_HN^e|g0J{L=6fXuW#OD~i)Lr2Op_
z>Ez{!g1j<${j_BodtOGVGRe^K{qZjscWk<9X2IJ5+kx9b+rir*+h4Z_07eon&WxkK
zeGG9rxy(P{K|uDUqeJ3=QgG$9NUiYBmH>vazJUT`byYW1_7o|Ju+A~pU(_f-*bvoq
zh1oVso--<teSYI+#!q71rQ?gJ)v$Q4Nvb7OSx3nG#1Q#U@@s#XUXMpl3)5eZ@ZWY4
zCBbr88y#UXUo_J=rHWJe*)$jH5H0#1kX}4ZJ#9K&IDL4Be71)=W7qrV)&|JT9<}K%
zb+pAvI<Cp5JA0JNo?%RqR>LAO{!YQppU#n?EX!}sQ`|M%Z5=Io|6J6;?+)XFitVvh
zzj_OF>w(wm*KXIi*8gyc^LNnzr{{(0_4j=A_4;$U>}f_mJ_QGx9xA#kW@NiglpE9*
zu{xL(aAeo-a@2i!1((*TE~J%75<cIR0ykV<Cr#*f+pt%aEr#XxLl(=e-o`maw~;Tr
zWbO-5Qv>-2nPVvxrG=5!%)evpPxw2)mo|2*GmFPEYg8^6gDEPi`_Q1>B4Nf{BcJ)Q
zcq*iOar{fdf>O|Lr!tA-i~1NBp3h%g_;j=$JC`MToM+mJZlf|1lQaJJ@7JKYVC9Ea
zyo`Heq4K1UKc0)!Jel|U(5(sAlm9OAV&ACbsmM2EzufO{jq`{HlD|R?`b!;@Hy9C0
ziE1cB82no(>xH_7AMX)%_hCnXzCk66Iq)gmD}4i7XchG~ig+`VCvITB-}0}>7a$4d
z211>M#dtiGGtQI|^DbExvM8l%zU)Yp)y7u({x#J^S4gX4NcsZm%TGhk6i~{z%l`M(
zt(M<0)q$g6@ZHzC<#WrkbiQ+$^sX0)*s@iM+3BfxmefUV)(S~)hEkl8dkA;Z+6J>J
zF!diBO~vX;9o_tK)BumDbQ0bSXyPWlH<u;ouf#@p467FSqPDA1{r1P97hzhB2r>@)
zN>RacCggj86>0OuxWI+UK%x?F>dPYc+Pjd}=!h3HF+=$WYZy-X-JJ<joc_TX1ytz%
zJykqQUnkc*ShFdp_?^MJ<woeCS^H-};wz~Fbyv3R^bg!)GI?mp!<sWBgwy)4?i<2h
zI#hdto`s2tX#cnU@T7d522`5OPkEhpHgF4iwwJLZ!*7VOLQ2JlhLu}y)=Qh(;a<jy
z^E(?nQy|_GedMua_$w3mSGc?w^gA@V$lwH{=6Lj~w>?0UVSSdJux*tL*x9-zBR$I@
zi0ctW2gZp0S|;@uhy!SN3PK9=L54tqe?$5bCy?|5@3)#SFe#2!<)$Rat6QIPDAlPw
z_~%n!=F&>4p78j@KZ&O##YxA;lvY_OndyvY)P=*x<p5G)!*24&7FB-RX#OZ*T|lk%
ze~w#$D#1p+Yn#A{XK)Hjr4gY<U>1_$-Ebx?@u|9W(GosI0ozo)mEYFBrmKJfZPJg5
zI(`+*CZA3>t=ghayhr@y>V)UZ3CXe4i%z><uQ-W4$%qEY2{{#{xrHKBsJis`)Ph~f
z5skHi?*m?LilX$MHC^5nJSn=G)7YA1yX@(zP@BbomK!Vc+?dZiVuxSTi_kWSFDbEa
zr!SACZ(F1pB1KBng>HfxxC5P%I!XSv4V{JYhqw82`@yqK9&_c{!@MxAy_bkmOmXt<
z2l-Mu;!Do+RQbb-xvq0KA>pML_1>tqs7Qe|f%IyD74b=!@yXm01}0;&%~VRo^s6~n
zqda~q?N+lHFLSi?{Jw;hS-r<6a{7I&?A+y3hga3a@PG!jX?h-Dr%yJ_a7h1Q!*{3>
zKNyY-AdMrt*qJn?cGPz732T&M?$kO8%_2;TA}B%Wj#?QB7Z|0dKiTBvWIatD&E)89
z=>M0Y#xNx;lIN>(TM}@&`k?#KN1DYeW1prQt}6Afe^5p}t(7OoD2L2OQKlBBuv1Oy
zP)u%rf6leQ(OjbbUq(~Fk^p{f0iSZZ@#fI8{nOjMYFN1F-Ci6KLC4|&6aDcFMtjG0
zQcym{)QStf1q$Y#aPt#SYmtlk;ri8=m8k2N7YHa=Hprtmqf8l5Z_reH*~p7>DMhe9
zb`DPFmNED`^4G#lzW=D($xU299q%|REm>R!9idC$Db5=E6gi(P;90CwP^b}nWv?k{
z*L(jWs*jF)h9*JKTZs+#5L_(K;ZSETNl(yWq%m$o-~6E#2|6Y10#>S53z0dRGHFiT
z`1^<c`z|_Lt-?HqLb<7Zs~&`^$a#b>|GBQpFykA!8VR`SJ^p>{`=%H+Z{ey)c8L>M
z+`9T}yVv+~QZwL9DP?2;(HgtVmQ*(xx!)iE@1f#y8xmM%d;R+~KhK3Pu%qrI=dvX%
zGe_l9%l!0`TLp8<XB1B-dy~)gSi`iF{?q-V;4({M#u>9%M}!|lV$bCxwN2T0Bqn0N
zs)3PXj(I3d?E=ju3;JBs$BDsw7=>~?5@WvqbbG;UpMDDG8WHK5pz@H{l?p96EoKLT
z{nB@~^vh|V(@TGk_<nw>O&%5OJ;LV6fS>il<o%a%DG&?}L>)kp%AROq6^Jk$^`Det
z@YRjma*Pt{<K|Od*2Od(2EB{P;lF<vOnk5>x62JH|GU(8GDH`O4E+1EI+C)w=Z=Gy
z3<=Gf;Aot_O<qN3Q8#2Dge)1@tGIZJXlfxC+F6H4UGgajSJ?3(Mg)Z}xVd0y4Mfgb
zUKHvDQw8}TPobnn2d78ureCG>cFEL@xT(HIdN;5-4fCbL2NxWzwM4Fh!^1ZbbBCVL
z&ehBz_5I=})BUbwq~@;Xo2wOeU~7ZMka%8W$1fD0+Wt;FaCVpNxuAneu-fv6EI(=x
z5Z)eb=pWK<9jlU%%3^BZFTYpA_8YVM+?l=g&150%*P)O*jt-<0(@<aNg6<~@wbrVc
zh<%@YqAt3D`R?~}Yh~$>@uoGqwRC2B>YcQERRLBlmcLlx9}xhz2DmKEgM3Ffy6^*+
zMF%-_quz)HV-ccOx1^F8Jahnz!W9|VEs~9a)FHkrPdYP|T=$}$KFJy*^tt9RpVHIt
zu}PRYAO|ez{qw0Mzys}2n)JgYgE-V?iJN>z<<s9gOSs-2euUb|wLva_6TN<0kvI)T
zzYlqDMkLo$$(}d~MhA<Mz$4IRZ-^r7@j^}#ku1m5VMynC2u#Fkqzo*W8H{gkTwSdk
z!&}@gUgQ>h|LMY6Dkt^v<xKdnuWYOjCI+-_htFgSuRsUB=>CBoZ~xwGZy*vnPEGM%
z%em#w##NBe90bSU&=y`x{6eQhVla7^<*<a#GGY)J^~*&=ah^cIXif;OeShPc>Gr0%
zYsth5srnjjGl$5Os454d7RMj<mi_N@<}`r7R*~I1A8mqe-S27ACy^NyQ%oxxhc@?G
z!q0@_aR{AKnBl3dvmdQvRxCE=$$Wk(`og`Vg>)G#uC-wH^v&*s9+FYb_?vUl`|oGU
z^(|*Z9);e)szidIDBGOB_9xVg6Sq=*rG!cNwKs`7q6h=-x%wf=DG8kFGQ&~JE7WYf
zMFsW5k}w8sU~x4B4o35A<MS_<jydsx!ltXv_@XmqY}~sjCWLg%SA<zSar@t4FH6O^
zfwv-VPTYd}YZYF$E$B0}VBIz-%pwj+vfuD)SoIfV0f)Tf<(-4xnrpdl>rud6KkIoD
z3c;N}X}9`0n0FoaHMpd1Cacv#x~Z{5%U|2TlC%P^G$=`3+&DD(6?>Hs@??;B^!_<I
z;9<eG{#b1gag@$qIK`QoCD6ctL;1#<gv3QBsNK$y>Ug+^@>P1R$<NNQvG0!X*s`?g
zY@Tn5b7>KHT8Df`dl8!zdHvsp4}p-PabDVe)4TFaD780}^%GK%hfIiBv2%$WBLP&T
z2cN*T5n%zlCNO)M5Vc#tBQ_E9<h$w8^hSX3*DvP`)1r+2ZN4aM5ne}mW@ceju8nyb
zKnfcE%`F@SauXzHZ_GzQGE!i?(k5|yx`(T<-2M&j11yD|)Gx1>h*Q1&dBtbE*%){A
zg^U{eBxQbNaBMwTeT)4gue-+gUDn(kDY^@@Tl=yg+!Fp@N3<ZXqq-usguMT*XafZh
zu;`K#v2=94zfe4#&r}CqlOaIh)M$FpZ*Nm`?Y6pYj6EpEN4kj+h$5X?1Dnkk=s*u>
zV9OyRm1Z8N1V>8C$9z>*{fesGPVEL6Z~-V4m^RYkY*K@n$1paK|M8P-Qhyv;x+QXC
zXR-0HT$6;%WRp`vsRgYQRNmE-Fa41Y^69D0m>B=PT7WG=0#S8x3&D|`4haibln0C{
zDQxX)RQuOCzeh57{iFIa91qxwJbEJ?j3l)ONtVU_N|9cCmJAXUZLr3>*2_h5g&?&v
zSqb7NrQrO+AT8xKg)U$T4}s^wuRA0OTsfwcZXrdQFho%P@wsGVJ~*@{OF07a2Jk@x
zYbVpRlGEyBg(k8)whv9RdFu_q**pRN72Obk8hn(%G}YrQI;}Bdg#&rK<euK+fv74K
zuZ?}w<vnU>vciT#D0Lro#0iGC<2N(M;0BxpjH4mfNRDFn7WSWhhA<U=|8uyg<;;s*
zes!U&R7%V_%?|yfF3R7>w(2})r<(i6j@aI$*Irp2k_(7O@Yh?7J++g(>q}#>JBTH6
zAb$9>KP_(`RNMz834k;KFyCGfl>fet@(|KKsy3)yx!MRulXN!cpp4?|U|b;G1z&3l
z{*6uibzuq+$|_$ecXN2Xm_8TUjnkT3lfWPaAW>q^SEz47K3%}vL3{e~3F&5yfcUX7
z|9M>k&?^MQ*ZX-qf+*OB5&)Va)HCp)?yrEFZ96KyLw|vH7jbPW_^%rp@P{nVvoxCu
z{S3bYUE)3!oEtYKjtgR@0zm0q)dg0+-x+}5o2$FYXvFCxV&_g5+y<o9!Tw>1K=;n(
zwRETu(Tk}FMM~x6EEI6-7RR6H+}~HG7kk_e<kNcY?yfQJ0@zB<GLJ|bGj_$ZiEy8#
znaOE4Tc#QJUaAXmwZx&!r4msAejk*UG4|&*9Xq)?js@}~tm`m$apFv7&@(_!(C`f6
z6VW|;e;)g95FnuAfxL+*X~tXUj+lu#L__TJ-AGlwh$z0!0eb^^HO|zhqhmVqr4aY-
zzZRgZMTj_?88L=B<R64Gz##HT{GBa$3`l<4!E!guagT(DOe%3ySho3{g1{TGQK}-q
z*Njr{yuCofkvyTul0)oIr}#GnBBZ~B5$g$!)0R%&^8Lsv`8ku3azJ4@+f~6Yu16b;
z0d&Oz9suWQ4A6(s-D5^;VFZ=`b2-n`;pD>MtawPEs2*l)9d$KSi}A$WL$hW6_-&Uc
z`W>ccDBsrY*?(e39Zi(ToLzW)a7xy)2NgzdbkL+95WigKWMX*ww+LmNZo2GfUf6pP
zQw{tB69HyVGpOkzxt}kj_U%66g!^hrZ#M}P(LsHO;2GGm{ush1rhCo<{;L}C7bOh9
ze1Hj804NIE4-m#jg{}7mJvkQ{Dkl)Lj+k6yraRmhS+fN@h8G|1Qn&m52KfHE`vQJz
z;bMEvFoahd;$rof8u7TFOXj8f(Ug91)+}XUX@ha9dk!r3e1l<5u;3o{x#c8_?%Ve1
z+UOGV{K2$w#r{WA8u#-CoUzhCRb<!A^^IF1Gr|Y2QDUH(PRuQ6lIR5y`Ze!c>51Bc
zk2VM5>Np8*5hhOArpSsMo8ED>$x!_#{sEYvbAzyh3YTx;s-B)0&K?2+3t2u08$qXO
z09~J;-CrV~l83Wy1|DZb^SW(d+CO;B2X4cqeeQL%|3y}pMhTRhj2!G!Hy;1bW14Fb
zATFBkusw$l&%gfLX@x6IDyVlO++quLr$yQJcP}s29uBLVC%o=J(>P8yqxK&?PH+zw
zZ(*#}pWzu(E4otNwB}OXJ4=}~^wXL7o5H1M%L9yQRPNP{4-opNYNoXXup%E}J8^0!
zc&e^(Ib6XFWDw8<Wl&o62f{YRs39Off#QraPDbf6ahz};$P)(=^lzX@rnDX5i@e=5
zVcndOvFims=6@n7LRq8Vs=x9}rlpKzsvB~QUVVqU7&^spx;o&xb6QrdGCu67@;G&`
z(wj3$vDWrBc@UFgv(AyRJ;);0^^n>gPRluN<&`<MzKwg~-N6H@^MZOLzEEhD;6uJH
zVd8rcI2;MzGsyCQ!dIsN+c^rNLL?H(dR2#XbYLFZOfEbhegV-Rk@KlfW$%fzZbxu&
zD@G8*7aD7aGHNdGDi;9jTtJ+|aksof05obrdF>jHCiPhoPXcQqX!L_Ba?Tl+n0&pZ
zm}0#pqYg(*zh<i{4S#AWeY|9RC~`I((Jdm`SkR8tMbT`}j^hPy?Fiz(1M#BLZI5Kn
zW#7upYk1!2VCULtZvzh~eZG<*ZjN}N+AONs_|r$?;EZ^D^SVFe_@?Xa9OJh9A;SWb
z@Zjf=oPl=~JRAfQi$E|b90KdmKndi#jcWg4DQUv{Y52sG*`{trwO2Z>nRgJu3=_l9
zIA9W8qTolxEoUaDpGk#l*Qhkachz!ZjpnvR$~_y86XU9*KG}y_w}ygnX`i}YPkb;A
z8dCwNmgv<z3J#U#7p>MNW6SfyS*_LHflt3z@h<P57eB^+UE+-Xr1~}odZIcnNW-8=
zFI<;7n|Z9jg!qqDXaCPt?;)~I&%zpMEfX12eZEV_9-I+cWKh5?x-Jm@Rpj*0D;XpJ
zDfbLYH;I^C`8mSuc35(X&Y^R0wj{u5#~q7`t`%j!x?XLBypoPz#fn<j_HLCj>ZaN5
zt)uPl_Q*(DlvsGCUbbfFaR3_~8yokwmtI2q+5i+kOCQE4{1v*;h2vBUcaSi4%Yf#?
z0XK$h{tFFhZx9PKP{npllM~gDE*Mwop^2Qh>_RA&7t+m^8{*?LxV$a*m<#Is=dPwt
zR;kfXvgbGg>1O#z?X)$>HP>?c>hiEIYELaz(&jDGs{PuU#QC(YcQw^8v&Ln^`R0du
zSgKKx<<NzFNLzW%wXcY8nLMNgc9K{Iw$}`UD#B36sN|Ei9(>xN(QV7FN|OPwkQds5
z{EQ6q5`c_%lbTu;*4!+j=jP-2HNK~Q4DL@P7A)eB`7A^Yn9%3h`5E#~bDm52XSZ5I
z=_G2kbmVm6vdABE5X;CpuD90t7t-4yVmweRH?h!XJDxmYx*PgySq)<@u~0BspQ%w|
z<|&Z&Vt~1|!9RMdD->t<MwNebF?{jf_AF&V6C<K+Yy<6>q^3@WBn3PqVW(Btres(%
zhH1Cuz&mMuq`fw_DGh?BXgQ{}3}43R7R@~(XF|Pgp&XSW8IrXX!3leXwDR*J<sBl4
zJeM_Ue4`u1WA!gqrV2;ehgixulDbk_?zmz#$gt^e8UOzo7&VUz@BTUr+U-OsFn4;!
zQhr7cKm+}X|F!Gqirgp?y`{N-J$5w&yW0_f7+399M(?c?>!*v-Z7804A9ABuueb3<
zq~ILRMJ*=C;X~EQsuUEdY#r{qu5@@%Vid8z-l`BR%e7vz&>*I&M{=5KF7Fam95=_~
z>${<(IzOPAp%{+qe_a~)L=j*5E`iBi&sS<i#LxSnK8mT<UllCn(=OGuKl1+#3Vj}6
z%Wh{YUM^uft02&5C5M9=*ZfQ<b<LJ+GY_0%VGX5+udhI)WM%y;>CEF@p{;fP(I(ql
ztmbOVs&N7zAJ^3_>^Ad4e@bP+A34K|9(gvzZGv@n8+duX5cr4ePK^!h)|t5ta<Z_a
z>lI}VZ&TV0-m}baVwsQ7KR;aDMTBtIwS8he7xjw=c4Sf8R1xo;`d&&aPUcFhrx{Pu
z$5Y>civohR;{gT;C-pMaTX)9%=jl@}I@d#*;uu9c5%jybYu3B;`AwLAC2C==MErMt
z=#*3yxuuIpv4k#_=}Rj=xxJ5g!ik&S8)XL0?F#SAuNP=#OPuH3&c`nvI#bOVU)P(q
zl%zIMTtlA1d$F9EIr?6$g2pga^I2FEmy(z8l{imHP&BGenuYSk>9tPaJUsA7aR#(@
zlC$5uQ6&*|U-R-DYgcYsx>;H41zr^r@jm((`821Gj8zZD$Fk&%9=D7vaH3~U7<oLl
zW{tnOExX62LEEGw4@y)g+hum;7so2aSJ1nn*c9atlKNK?ww~tB_s~J<At3TySk2a&
zqkJ2Y>Fvoz$i!sHqLyksRS&Y(F1lz+Ph@JQyUiK6I7R0=PWxyFf?jKLgR;Iiq!ZDI
z$#Y@_vLjThH|gF}detcZeA5a)zZRBFp9#$B%Tp&8TZiLCg<)Gz&n6ekjI}}bjvr_%
z;M^=F67)u>_<j_5&78SmqEzG&pdgsoqrwm^Nog6GGcZ2{kG}u`xkqemTEZF&!UMY1
zuN^7=m4vV?!IO51qTFn*mK7OeJ?FMaohM(c7qK#N+dWk=sMe<>X?YvVG}W_=r?NSP
zThBk-jkzSVikCUY$0u&Md#wz?i*NXxu-msa{yGE^d11#~y*fRsQ(IpmSh+P#z4wxi
zOrkB92Emx0km2yJc3gC9Rs+pwwgd-v(~VzXjc$4lD|h!w0!6DRj_%g{rjjL3I8V>m
zo+mv?^Vrh%`o9r}8S{&O`iqnTHAyqhpH=`59rEVs3>#rRZA5xz2c3uH3c}g^-9(MB
zaw9W}_xevL)z+p7mC~)B+chuI4)i&=_`f-x^a#}6x&g>&{XhkX((<JIq?tVvAi<gQ
zbiDOBYZAdebDuKS;b>1R30SXq&ud^ZOVxoTq179JSQ&YyL9&{fV}L}};2%1q6G~fs
zx}lY!pWCD~9g*F-{BA(o1(|ujUM;P<^L*=r;p|BCU)&RfcXautIyOjy2dNM#+NWoH
ziH>gtj}%VN1_#QR$6Foa$?%d@VgcAhje<389u9#DDF4uesk+#(`=zK5$UwO>IKvYS
z2{tFpUd@PC8P1ymp4GOLQ+n1OA(KB**4hB<Yo{H|Y<1I8$oEC$(=*0=Gy3TzO-)oy
zx+diiNN{gJ)+-@n2EL()%#l&A&kT~^4!=J;dwP}Mwh9>>G_=)@-_-H73_$g0+K-3c
zwI8>KYJDfXyGcUl_BHERQ0gknB1XP+qcOp_Mo^8+eQt4Wk*YGow&tXrUX#EeD-x<-
zy+}lM)Y`Pv88Zo_*VR#iR<t68q=i(L!W%6HSchPpPKt(~&S~2rlmHRqGaIZ~JeeQ9
z-8VHT=eb8aQ87`kG$<kASt^v&-ZCr-fj26bp>o8bZ&G^>p<ysyD&5`WXx;Y{kGf-i
zhudSGKek3^S+}*aVN*Z2_>nK~5AfN|`Yd}oj;n~Lp(kH#6*n{K=iV-9W+?joe3Edk
z9?!_F<v6Mwuu|AGS53YZ49*o0>hVvk^XY}BE`tw-JIY&wKxu*$OJdg&@byqnT~amb
z*eBwwHw~+ek3|$%WM_)P+zJcn>m(#?4qaq<r^gcDy})-K(-lo6qL@r)xYK%cj&10D
zP!UBJ4@Wdf@f*_@Q!`lL>nlFFFYbCQCaQ8oqe0u@Sl=b@Jtj5tdfOPh7@6%}IA`6>
zu-3v6JLUHwy37)V28*FKC71V17q$#AfQ264D$5M_UfIjrdTFEL@jPiG1lWr*m}@@v
z%Tfw;BYSAWM>8XPAENWF>`U?6ZKQFTG!KYXs)XAk&jUUE68z5xgum|-b-l7`kWv-S
zh^#mgWz#MW?dMvzgG&}~CE*B}-f%*OgxZ~1WWFIng?Qrx`YuWMT`=fs3pn`@-(vV4
z3C6;juK1EP^<F#dzCvr_MR<oUp{n~qD^0Sq3js6>6}p2jTqy1bN1i@s=FrxL)P*nW
zu-PZ|Rp2WlK&pOKAkg1?C6fZQ52n38$>mZj&NF(mdb^G$O`=du2E}dvHoRCiQrZ_=
z!iD=>0(1u*Qzje6`ZCwSceKEgvo<j2u@;Ps*Xm~E64mmTG)XqP8Z|<r)SWN>ifHn4
zXL1CtZ2Ik%xk&lU{LjObVQkA9+bHOn_4b=Kjo<NZ2{K7hNl{lqe4_+Lp-@{5$B#Fw
zSHVCT(~*my-^T|bftXB~SskF~H<)izmJ5K=2J>v^hNTfd*QnxU9r$eudME9!Bw)LW
zd9Fo_&Z&OJ&qKD^6oQd%0lSF+oGato67kXJeYR;8;+yHlE%_;rH@A$Cv^79yDTK5y
zwEjv%I!}2dmtLJ(TRJufwwThC;TnvvlGmGLbY$JW?ADhOJr&sUnbBB2A4tyJ8Po?(
zKS}>AJ%m(Xw#D#q5gfgp%d@J~!x>J0%M`_seldrrGG)DuDj}vhM%~g<aTHpcWnm#E
z>P`H{EWpFW+YO+2@@-Dj6#xbF*=gj(VQtV6$&u8tRR6ByR9S=0(r2V60uZ;#a_$We
zpzEUOjGr#CB#WUlJ-C?(x3)^`>UA794eI1vxz<kz;5&)L@>YLxc(_i=xUUIo!9-Y(
z04{>#wLNk)Xg`gvG+plYnL*5H_jfb!;)Tb<VyG~&y|%wu4KH3N(u_as4G<S<`_Urb
zdtEct4BS0TtOG(pAl3PR(-Af41$wNv(!0(*^&$wtemZ5eINHb2R0(5P);ollkW!DO
zwWU2mNddpqE*x$CstKc!#0fwqN&IX^Nq5(H82o+jI@rghJ8tZTcLB|9YEaT|H=_}&
z7U{<Jc=%-nZoE_;Lkq<h`eUbtk9+O>K504u+qFxw=ZZr97L#>ZzZ{?jGU!xhsS^5z
zCE%+cD!xh#tRQq<>E`H^E@}ENCOBkAE@Ec6#9#B~9sBs2$O!G(UeilOuSPmcrx)a~
ziy2tMD>cwEqDCxFT;KvuJKy1z%?fpDq2tiR5P~K?<XCZ^r;-gBinrAI$MVk+BD+7H
zozwyw5|^uDLXJ%BXJRRL*Sise6#gl&b`ob;S7)<9AE|Qgta7bHMd#SFQ@VKkgaNrC
zT>(;lN$FeB#LJVVYvrtt;7n77u9%9Q?S;P?jRF7{vCx8{c48^6xZ7wFoiF)Bc>|hZ
zw1y5L4Z&@N*r_I}k9In}X@7J{2eL0U?mpqkSo*Abu|@@QAeG{mY;B3d8Oem-ni&)<
zhQyWUHw>%&;}Dky`_{XLuiXWE*I+`-P);5?>S{&|iI#i%_jW`$On-0@(|V)?pc_8R
zfJ4I`#kme4FVDw3Eo!G|pmtqm#g?Jnk&C}$DjD4**ro`Qg1BWs+Uxh5lb!;-8)5Us
z`Vl?y#$260rgXw!<KkmYRlNc-Ip*KWS*ae7rf46zq}Um|@5L<ra@NLuw)$+&b~x`T
z5)yU2{4{BAZCBPNwJm+B#Au94_`C<(bE$4P&E2nYdB*hObXzyHSV(g7zZuw*mOS?}
zwSS-H@XI$VCYRPAV)#`g)#+-w&^+2&y6znEYjkXS&kwrHiigvFUd#&`&u9c?gey19
zO(@r!IYA1G^#8;8AbpMGT;2&@$nYKdZk&`ReUV@;de4jC7PALux58`B-h}kjSH>l%
zBGidaG{<TzYjZo!cCJ%TJ>X9pHR@&f<%fU#tPKdGX$}!2lRM-!I-LedOFloioz&}o
z9lcLnG5ujVhOLnxQNXG#0oB5{=NPedelzzY`GcT;$|F!&j#1_I({}udZ_1y%9_<bq
zJT2@2mH#AI-^c*tq*7o$9ELNyREq#_n7B?1iQX$dE2b3*?yWPu)%U2>o$hjadH_?3
z+z@5JYVfb4i={xhx2%*e8Xl<L9nC8#FVCzXmrZtsF8ShlJzlEfU)~_h*93mx5{cu{
z{ykf{O;cIRdQi(!fg2if{{nBcRyzhQcDMg9=io|o6Z^*L4&=pdut5@K{G=Aq=VZnV
zcU-l9=9al|QJTIR6(Y2uW3G&*ing+ft79j5w*xHHg<5u;Lf-DuM>6G`MoltTyh-l*
zoYKDj%R`ib{oDrEqJd?e-<$ET_y`Xe&kl|I-b3k{y<1f?NlLBgVDN+gmIO~x`NPZ<
z+4G8PsWg?f7&4(9P0F`3gLv6cW$N+3vGle{zrEjpXoNrxuivNkyEoJXJF|WbZCPD`
z;$l>)c4;{MvYph49XGQOrXYz7!@SO;NBM>)-4Fxf+oFnFg6*HsWWxsU&R2LaJrhE4
z?87rQ4Rp4@^_|v&7kQN5a~%HCPgw{|w5=&~-#67}*V(v+A?sJ8SsNrELdU!Q;B`W$
zV#4`$i8;VhcQMbuSC0Qt#FLxJPRr6E+<iB7>!RTIM=RBqI^jHFD<tm?EbeC6KIyri
zHW^a5<~9Q#&4MmV6FvrGkGKucty4D=9fW)_TRX(2LN<J7-#Ujbkyv|;DuKd~xyB*w
zG%FrEjpMFJD66@#Rm7yDep-~oc#PQf5AP-L-FRbshymjfq9~9O>(<ICk8xBy_qLsC
zUdxWf*C=s2K=0mK+D&HW10cqfGM%2H=bkTgD0o)g&KPy`2=piwTQK3gX_GewktRTf
zM5+KHa}(GH?ad(|FN;3Hk&IODF#<66*%w{aANVm+bPId^L7NT>!=b3cDC*gT-n&dS
zYVQZyjh6RWq>)*nS@;tvQRPdqg&w4FwI+o8bcJtL1g0U|t#s@3<A<(Dzka4*fl;U6
zth-L~j6m88j1ped;t~A@=k<#8Y`v&*vMBkyygwy@h3oW}IUv%cYnaut9d>=FdZ)Kv
zFj@E@!A*F5I&mBNlK-8goyQYGiVlJ-($Fm$BB0zO3ms!Y-vUCqfHNo_mexmrZjPpA
zwFb>UEBnJz#bgA=n&cO@x^2oALNXf3OfJTWC=6?Y%BD1n3|bbiP}T~n3ZI;)tk<?8
zCle<@I$~t7!`Aa&P|8gpl$>v869Po%SBtVwtWDC$$4R6sOp+wY_wHfM3I|&GQILI@
z88hcbOx5S;wE4YAR|FT!F0(|2oeawi^rO7cZ%bsEGa8v9?0VqueqA3B-v2y!Gz7y}
z%AI}H=uHK!Kzw91jqqDubdUl%$qy>N4_lh2fx8i?j!|)RCW#1{DC!8!5b)2nu$j6^
z{N<T&Wb<8j73YG^>IrR$`?qg>hAgk@&#ZMCM_M9WEV2yA<lhe6|F#x2GX<48-IzUD
zW%oI5dkpLkr*es3FTEdd_FN`fexevAoaa+Ar8aLQMQP3D;lEzk@D`hqa-z6*2ew<S
zR)gA~jqNGlZPc$Tavrpgy=8w`%Gp(mCxL(??J?!2@b0nepbLC1zl*MfsD`ZTEbRIZ
zQR2KHsmomIPyDD#S4>j_ZnoEsQ^btj*%^+1-KW34(yAg^sLa<;G-7~frM|a{L|7%6
zEmplK+4&Z1_@2uSC(^6iKSDd-914UGK?b$`_Vy>s?Qrsi<*_(B)lXznJsG2^n7UM#
zRqv<hM7aa5CTMiM*KTk%6!LlRZ1LK<w({U8w%+xLDf29|I=b;f#;wyvojf?Z$x;ZY
zat%5r5$<r+^#{TZyCG*Xg@W&0@UEi>i*1;q$Ot0=@a>?S0{yU^RmmLW5=ism@EpM;
zV*{%?%9mu#$Lwo@0D=g{s`R)j)4cgS>_-~(%_Nq@T)_uusO#J$xB}1oOa!MBN?YRb
zI)Sx;9f92BlaE%cz*4yA*Qd#fdkdJES76bnWE+_g*VbD2*&|2yG4tJP5K@&KmRFrM
z*P?KpAs=04OJSOOT@RT{MGe&)Inp&Zb`eKG@VH#ST4+mkMvwLYzFo$cCi(0-@Fr0}
zsPJ&$*rVH+I81xoeIoUYaCg&^yEAS?Wk<p_|JwfFrq^eVKM!8&g8Tp)OAod@>9tZ(
z_knGbvb*VwPdgH91+ANM*q?dw5%@wY$_fO7X_i^8t(Y;K>W*f-p>@6r^mB3dDWq$c
zMiXTc+}DFH=tX>ljgmJv;LxU>WhMy)c<!tZ?oD*+UridrU`PlQ8i#K=qEJN%#rr*T
zvH-R`a_LNm0U7}#kwkoOsvq+ZD565qkeKb!_CA{Gqe}SBVM(QQ7)=cjH<XUxRxVLS
zv=MvrNNL+#iU0JA5~i_zbbY&j&CG}BL37}UQ8}sp36_s<j|Rt}$hvuk$sQdD4udrv
zTHZFWNVCVlL1`$7#oA&QaTZv0S$LnWCY)BcZi{J;2C`^W=tW+WD$0q|tOa@)n(CL<
z#g2!TJcNhhf$=&e=PSaB;Z!HsV#G_J#rm<v?>)GaJwgDI7PV<^-?l`-8x7QgdMW#y
z=I#qk6TMM3-@-q^ijheWWOvCc%;W|rN!^!9yDxk@=6i51x#LZTVt#AQ))OmdROv23
zG}BXZBo7HMe+lMsy-1s_$%KS|wBY4V%pBU){o@d$EK`euR%FrR!ac|#jcPL#U%3BT
zhh(cua;pEHfV5*is0xH5Q6QUM(bX4n?46rG&9_<Sb$)5cfVSQ|$duEgs0vPTq&BSw
z0Fg-Q5d}Z`AcYKfY|ei7;~&C+R2iJAdPk=T1J#iVgS}3EKQ3jk7FnOcsoSbM%Qu`u
z@ri!ttZJfcsuWCL<vQSkpCO+kVe+we!Vp4Rm8Jq}!?=-iw8d^dSyQAWVj&L0CSBg;
z?xS2QrpS8zzKga6*Vrp>@HPx$j6eq;UW==k(lO%KKmj2iC}vPdsQfh7FEp|yPl-@h
z-_FEZYd6D4@?OZ`R-7S^Q1;S=oKpJIIpN0!kob(Hk~`$%L#3<Qv98x`fY_y`AY(~H
z-lO|d-d^WZfuyji5`g?_8;kaHzm?0g_xr3E$(<hlZO64*>W#t@dwM#}OV0hZ3#inL
zK0BrCql>RRH*RxbMSR;nH~10vW>2*NcBphTB>l(eJCju9Qu;*&h8y>LMch!YVa9*p
znB2^`5dw2cMMTzhS5&ak-Ca>Q<bYlo)isqPdDP(JhnZjKZxS0|;oGs;AmP!L_;R}%
z0XZ5QKq%qs!rin>$;rY3JHc;>x6(j+;VzJxxx08shL;hEDh2-deCg@6Q@6cTuy6uY
z>~`*L<%%4<Z;r(GrmnaWW%LcpTt>z^2UP&Ul($ZXU)-h*KG>J3Ilw(ucCjULj!PYm
z???RFgHh#Uu3?yq{Ft~Sy!h!N0*^cII;-1Uu5K>^+i+^6{=e9=e-Nm*VSb@WBz6Fl
z(bVajEFM`RQy9{iZ-KPgBrHsnU(>#R+EySg{AKfPjavSG@UBWN#MKu#apCTarV~py
z9cSLMtvqcPdEq_#maU@d<ehIb)%l|Z3+p#lC5aBvh3A(=re$t#HyLL5Vj{J$**2~d
zy}q&|GSS54dMt9j81xSZFm6?IRPIy`1>BO5Mjeyuf_t1gn3%5TBlgJB;u}nD;(Y3}
zz)9*tl?w49nTi&OV9VkCT1|gd8iE?SE8Hom!{cHOjW8Ad?ZAJOKGSd}g}S9k(li_5
zWRVE*vAuVe7AYePNTUQ8>JeevhXoN_en*4F(9gu(kYjd55nflO12LqR(YW0RjSf0G
z09QlX-W57K$;IwE`H740GCY2vmS;A--^d|<Ni)XWXZNh~B$G>avXIY}aqV=L^6d6{
zKe)`h+VD#=hSRtQ#8>uMX98!agk!f&=8`Kn%9#vix5Jv3_HI^-nM*TvJv92wH1df2
zZn0sZ;wd$n_3!v)iq7Fe`r{n+O>P*yZGyXrE#)1F5&u5;&7<l)(4>lO74CpnMBKmT
z`GzWrtgEaiV(i*=2`^gU{Wacdxttd-Dk;qkA7w13^lwZ&ROBsZ!V5tRq24AN1SEif
z4I=bC_+?IfFm#p0yX9O~J}<#)O=Ok>rFt^~c}dEnWwHpgz}ugdPeGsrOg-!tAYLqT
z6zrU|uREQr=KxjXX*!f)hK})u0@#)#0N-BrJSTUy*a~%1W$YATt@T$M*lAG)YYeic
zAV8A7DG9KDMRO+x-;>H`@!6h@_wvSJ&vV<OI6$&NJRM}pKz$Vd!yb`&ETeJIF@$`m
zb>WdAzUbo|x{`3ALsYZg&{sa$oU%Q!61o~k7`5QnloG<Lfq!>G95?B)!JwZUPZaFV
z2O|B#mgwjt;}M8-Ru@_J-k$%3!Q{;Y4kX&G^U?V1nSy-q*bm@EiM+Mp#V|=)OWyOW
zY_9#^zRE2;H?8AeNsxM`i-OXe?l7*IvcO7}lhrSJDcT89I-HM;-yVNByuMPiNSvRT
ziBzsNq8ds&kP@%g*1Y)@9|<~8X<Sg3D=WA{Dj4m+<J#2Vw=H?MRCDNX&fu&&kiIC!
zJiI7N$e^iB+~2i~qS;|GyYS;;DM7f(=9bCA`<GFCt>|XKk28*q854!Z*Rc%q;3|(k
z_kPRkZYg5Lg8XPgHT<%$%TB_jtg5%vMZyO4oZ}BbokHFsM^gD|FPaV-w3+S4b4~61
z=~(8xtc98i?NEdS%jUlXb%qheG)W+6q@ZJ1aNnxpN>=vRWRCDZYQR{nd<k~!in%Uw
zn<H^+M@P`YG*7=<wHj@fh9Uwc3yYRD5p?a@r7#^cYg^<53i4v{U#P_37@tJ5By{Ej
z?u}Rr0`r4-wPQ@KOL0RH4n0UZMdPbnlh+==1r$)iDFJ9<LItv^l>?qE;<+En*ix>J
z`78=-b?)Jvfl`+C7RvIogeJ$K>m-!d?JY+?{e{`KsM9L7?i_FpRn~j6v^-OwGRmWW
z+nyx1pk!xvAm6Z7gLe^>z9e<X_FS;8MdxtNMyI}R-mo{PK!;9r_F48k<av%3YG+lk
z+02(RhQutpj|=OgLgQM6yKPTX2Kis?q)kXHC005e-CS?easwav!2k%(9PwpX{$()|
zn!y!jz^@pf#{<59F9*ap!oiHxzZBmQDKMeFTb(psakW~xp8FN6nN4W25-2d~{LNhL
zW6y*TTJ)7uYo<-vQwYw|XGb2Sy;H~^U}I{+hYgxEF3;f)v;3|{O=pFA9p0-CqKQCJ
z<-JvSiASt<%1G6~Ld$LDnMu}Q<kItk!g2!^F|E6jyng*Mpl_jZ_|U6hT42J;(70{g
z2yCW5&T1@K0AAYi$Ns6c-FnGy2URaQ`|1!H*U@N;p-a7=dvl=`X$z{8P=Tv8SE$&P
z<`E4JPt`MS8vEVRp!qUHqsfH;gSNlK$BRByi{->*{*-4O1p0FzQKB?PRiWY6g3lZf
z3a04N3EhoEVaR^o<%t}}m&xA$bf3e=E`3-=Hhjr+si!>KydmtQG`C(_BOVGK8(IAe
zqH=(+WHGvbEh@&|`uU~WQ9^~Xr_IO(1=|6%P%%72K=ISR<|KX%8~#}ak8?ycSJPOf
z8IUbb7Z;v?&7Ju<N2A~8^PCPM_j=S=>@DS$%Voi9V&u%t-y=={r@9yEW&k*WKaprZ
zoCrG)g>I{sZfqg+Vw4I9oxBoBW1Voy<sdX>ijx<@`?&KZf-H!Qh&N(;;=m>ZR~L_3
zWd-^n;^ze)B}u9$_l#?&a3nbcmmH$lqSpa9CCX6;V=jX4m2e0nE3PofhH6xxof@}i
z@L5V#=?7mx=CS>bD;=odVNNkzQT)(unWy~9=4!<&9X?zCDK(rftg4wBfU1=q$A!(e
zCib-r3^jj4Sb(PN?(FXMxexnbJ-=+y@2l^9^uF6Q-30qyi_bTojw2h_u3j#dI_P?@
zLRl!8LV7;!+Fx?aImltOp6ERGGc_LI<xDHZT8gO)brTmIPX!#)Hv)VK+eGlyAQ(UP
zH06^nn_+0$Q<teOy+Zxv5L5&^k5`%PgVB#A%Yrl>`;Rum4h@)FQ=Nnghvoi9XUHS|
z)G-b>BbxaWA5`7kB`oue<QFF)6!g>LAc}c(#H*529|@5E>VFkdW{eqAM}cGdL?Td}
z`-Z0vHlp1s9oA>`tbB7}ld?Q)pSrp9o515-%ZqA?gx|JAfeL+0^zI;<rU33Cfq=T(
z%3*&dctH$UHlC-)&eV43m|b`T5s`-VU=b3*U=kmn^ci94SEz8P1nQPo0jZ-oVZy}3
zmBK#z0??^E8Og+#f&|7t77Ln0?^x6s)xK=PDsaqweSh(2*1p-u4A&Ct!fD4W^a=ts
ztYPR?|CBfE07|yb%)ZZ?8_kfe)K>e9th-8*vvxq>|6n&mt3#sl`B6$6%!#J83eXp5
z6i)h%yo<IYC@pU8Cp^Uup^UG+ZeV!F?Mc(P*3W+mSdnB3{wfjUYyw^eIE8nIV`gMu
z(yCSkcMWHpZ!X>*>EG@3Ubk2#(17RAS?8`6hhPZ~{emPD!<!|Tc^apl?r+90=sJi+
z7Kg7Nh{{lEJ;jiINU~mO|L{H}=YI72k)gP#nEaV<`SHsM!R{;M#<2Hx%S~nI(O@q7
zAnGE65b3*n!pa>v6oxmri%bN*%0p`a(l?fq=RO|w6J>N%%IJBVcPGIhvVJcF`}}8y
z@Zb92B2$=~SY$`Mis?j#<pMM+l0;Pm8<2%=XFhzxO;7tOU*8P=+&vda_B%0}qJK}Y
zL~;I+M`h~+hKl0*z@!=t5(u$J>Trg4P&i^#U7-}guV-4n@#wSo=8gz{)T%cbUM+XF
zCPSKTY23t4XC(85e)oma=w$7c#s-NpJJkg$ViwhfT13!$Cr%qi1nJjbk6s&Ozp>AT
zj!`MQ8aF$}Lj6Qy?hBLIT!#YJL^$u!fzs;Np0H;g9qdq*33+lZypNAtOgQJb71~g%
zbV(e%93A)otYRiw?6cf8v1<s~kZUc0!zR4QA=VcG4R+UWjOedjbS*B&kT2b9D1(>W
z@1yP>FCtB+_=q+{PhM9p89Ua_ZyJn5qVw7k=3bWF`y=p(5Pp+YZAU%fxI!SDaTj^?
zdLdl7Vwl?bw-DmY8XwPl#<lQ1<vd<jMeoNAX@}>JbM(l~9E$nC=5o}##Hm~<a6jIf
zE@c6drL*3Ctm$X*3MDtF)m91xttSWErCy&zwt7079r^`60ot%n3(icB@BHO~i*1`m
zAD)xzskqsv`qGOz=R@-$N|Cx>d=&8G@}QT>X`65ktRJP==cHZP5ryvD*H-l!K*{ud
zc>Bi5RT5-hZ}uzFbqsYeog6DZiRLTx<ip==Fp9?2am;p4W)N#V=wj!$K8~a4vOF0A
zsI)hr5yU|9s08J@sd!uaTg@D@s0(PKvG!NNSOTHY4{zABraR!$sX?j{gj_{U0vdXP
zxDf3LyQi$d^4OiwBFLpsS^gnR;>-mTM8uwEKXk}&toYI9+-M5;A;D2j-yjtbDIO+0
z5dq3nOqbrHI%)`<^-K1^=bTPt#lIX+jjF4A<%<q8v;RUV*t-UbmN`5kQYNiGp1Pk>
z&$m6LP5~|Q9%Q{XD7G*Ut9tFD;cJf$#MR!B)YC&4w`c1NJI(XGXVc@4Z8^m?Hj~#3
z&+a2f7($4ozR;H;Z0)c#S4-|)PY2qhnR>!7n7P4Z2%qJZtw`u(V3ajPzS5YPeSt(L
zfkqel`CK_Xn4H>poYp7(o;5l7;L>wn%HeqT+U{8W!1F4(>^X4eJ(E{qsQCP^7Rn|5
zlQJaHIedS%ByyLi0QUz|-~qu$7`m#C0`gBwysFLEH|{}uk!Ws-#JaoaaC|Pu_oep5
zq2GrBxQ8Vz?E3ZQ?oEz=8I_<*1op7+$hxvOrgan8=Ski8OQA{hApsa;ri@#e<B*Y=
zrMj<`?^vnMNT!X!9`K9=d^`t@U9*>tpi1oE9Q{V&H#tSo>6Sv5U6*FQkI;%yUZRM%
zt`kqU;7LuHQX#(CCe8wG!kz(CI5LQg<5N9rM2d9-Q~&5&bLa?tnt{++cj#ysK^R}3
z_ot245D1jA(#?efO9TF%5>)&nh8V`=;YGwkL-`d<r{{^B;pG)D=>4qNG-`7oqV#1r
z3QY=`jJQ-tc>Q8;9Za6@934914ohguj{bVDyBmUO9Ito}j^DK-uB2Rb1;x8()?giu
zuGY%bA2&axkuz)EmYxNTh}~G<FJ<f_6oqP_p4YU)*zG4AMm)tQBouA)F-4hl`Y=On
z3ecpjEW2LL@D59O;JD)D3j2I(o&LU%dCgCHIDw+_8a#6`jV;c<_Z~xkb*Wh0)?%)R
zpV019s%j)W$2lrc0y>7&e?0!v#+%;y^rhR8O(rzVuVhg%Z(klsn0Et1&_`LD+XpA2
zV&l5EMxu+}Zn<$n_F=!PxulaXGj9KRjb1IN_d1fTMxf)^*ChZI6iue6kC~|!4gEo6
zv$gW3q6TIhiyCQ)ED({RIkFp}9N4>d9VR^)9w36ztbNZyF&u{&TmXSFXk1H7=t#m`
z2yDv9_H&i3jIxQ{D(3quIl-i)kEEYF;D7r#bz5MEW%;M0NuVZ~Ria7Sjj*mUCPR;}
z^iXqMJ<crXXbBY%-B!`d(eQcPb0d?!JFE<tq@6G&b-Q8T=7kn!xh;S0MXqi3*!@Vz
z)3HGO6s80US8;4p3l8Mt>a#yq_pY;LW=gH?AM2@S^>XGpE^AdIpfSDtdg;q6YTJ5H
z>E(;+3Fo3;kj84L-iFR@qnu~C${aeqBjMFV=p3zscs*@lzKTqid%gMz^@Hs>o3YD*
z9GCc2UJkyvSFml+9oWe&2e$AVI<KqIk}QhRq7X{JiuRCA&V;g?j%-!%yUle5NLsg-
zI{4hwK3aJv^z5(ox+54%As7bURX7SN14zh@maSlkZP!&{-WK3>Q<B5&&6(*EKMO?i
zPy<o)Noe0&0`bqPB)rpW<Arb(YHsCv9KX?n;ezqqQP5F8Es!v<>uGJ0ScQ?iD|KJ3
zn-LVqBs9Z-#@}PV_jv=-5uOZb5`&&C^+u%=C}dA^A^9;&@6Z0KJH-h169c}l|GN*r
zIl}VLwEHk~AwnNemLAf(Te;?An{7OM;tS{ubcgH4mdD-8Zb3Fd5WeoJ={#(9kKs7^
z+(&6srL8relN(^K(s%5lg(a+GuNTKEcj~s{pC=-3&5xQ-F19}k5!oiLZYRVSf455H
zgZ|y}{5#kd(wKMg@mJd=&b>EY9p6UZ$j;3|k9lWhEYx%u*4|Da%7kMxKav)QDJ#7D
zcnO|%Q7YrYa_`P}nAdXj--);<j{(6=BEvAQ?(~9iSRf_C0whTwp)qh*5h!YKXvlmg
zYjm#HA;Erd6pYyqpUI%D%Ar_ynxzw9!fGpjYR4!1*b{)yv9UnMI+4VB*Y%a65aPSH
zseKOG`+)1^vR^Lq3!vLg6@*;=Nd6_PC-;Gz$Uw%Za=jo_pCp!!SBMW8I6tN!kjv{}
zh2SaHWljBK0N^DF*Ehhjz2B!!a1qr+%qK|#M3s_e-@FdCK4V$FTB527D%cirn>2^@
zU|~732R@V=f%v;74a#)PP**7vnvJWs^$b3$L}mWN!6))CLfw9VFr0F{rPkCMI~E-w
z6S<fy;2e%C6;{OCjq4c3EB6)!U`o^d@$wN})c5@?A!BYKf9{2iGlb$4qhU{xt0&6m
z53ObnbrAT8A6w_O)PN>_>|FWi-Qt0VbSI=TaS}M#_~*}S;^am`@8SfCzpB7fFzi&A
zad>|dZ9;=KK~Ye#G48$`JeYd7i95{|93gLP78(fvtL|cEC;RNAKc$mw4cp&$bU*Pb
zC)r#~<$k~>dF6{2_5opyI!>O|JyITfuS5M)FJe}(<*L67PIpGRSU4dUJxRpx(j^f<
z#;r467MB~@!U5lU`01PB>67`yZzmJKMlJJzDe`V~LyO3F-2{ds6Wx9fZ&MLog69i7
zAbvx3d>;JpI|nj$m=C3h&Ud4nsG<RC`mrNl<u!8g4+fOhZx=utdIhQ&Hq>W!UlR2H
z$JSdoMA>!y!U#hP3`2K^(x7yANGT=VA>G~GARyh{H6YS0A|VYUjYv1raW3xL=Q;2D
zo$n8r+3Q++)n4&i^N;%LQmmHkgbIPC)T8NLR7iH6hD8rVb;~grenU(Va3Ea|(V{dV
zSuiMHGSo;B^sydaEFzyZ0`iNaV8lZ2<?{thlO+!C++!ZYxxmgah}U4#4@?K6cSkai
zz+{K^n`8pZdx{jJ4g-=Kb;%xvkk?x#vE!vP?{E3>kGQxp-+d0_X`OWY01GE?e_-)?
zj6K>(a^ISGhZR@K1v_^xj!q^c7JkE%bp~-A^{X1*^56B(DG0ao$&?o63DwtVKZ}}h
zv2pVdBdt(qiKAZhJrZC-2$vL(p&R^v6@a&3hU_%pOpu!V1#8C^BMJ#f&N4S=?k6@<
z7NU3^qT-&{QXA3DxJHI~>d#L7S|H>N<V5Hl^t`ez2BXs__!JE1E;rbO_U;RQz>_e-
zU2P}F{Zr-@G#!3#FU^QMOGYied{p@`soQ#dDJqI+bm!q-$Yf>Ih!i()+fW5GJ{2mE
z?tlpq;Eg7cuWv|S?r&tU+vO}9xS9Waa5-J`-NB{PKYp$(Tu>{#c$qdBzimiJKqio&
z^!8HO=DLV=E2c0fzlJY<ithk<`@AJw$T)&`UUidi=a}J7CtsHHOw+)|4KXZ$KgaKw
z#_P}Z&iV1d(Jo^cujSPtlfe}Ao{Re2OescbBkW>I9Q`npfI>j_sJQK+ieM*=K7O04
ziS>YgUUS^YcgJPs6O%Hryk?f5+ELQ2{UFUtUlH}Wr0L@K6#NH6r8`b3$i9B=)1ND_
zlr4Kg5MosE`-z5I%f5@Y{%R3(sn`{uF!}%GKeSo**KwOK7Ikp8<}W!?xbNe#PTD@=
z^^;9CoVAbSjd$D5scBD~wn4|6RQv5fQ`Hz#@Le3_yLtdd5%0OTmjSqpm{W+~6UIRH
z8-0l-hK<e2fl2Y3;9|W8+wgL57!O}$T=|Mn0%rc!iuZwlSNWr<Eq2(k=dU>TozXRe
zy>6-wJ2C}diaQn5P_gOSuQD!EUud?&oTaxZDcJrzew4<@DXEp<?YLf_dsR0MB7T_O
za!G~oeAYWf19UTqymgJGb*DYG++aLD#V|v(Z~Fdg3JQN?^|-uiHiWM)nX+wbcdluk
z|Gunrr#)_bw^`45m;J_Lgp>tFxt@SjU~yQr$=^McmHvI_ey*!fdFFnB>(kUIL0l07
z#Z>^k?^Q5lSL8>`H<6v28j)MNKhBWNCC;$cY~d`V^P7+`LB7ZmC0$9bQq~z?--r6h
z^Do1N!Ab4>(MtCBF~Tj^zORM1C^pcU>?1h(wT#~!a15rI>|dWn{MQBWQh)P|z=OMu
zfz2MJk27F}B-)PFW51=G>Fa10>*)>GEUAROW(APLFb(Wzhyh!uke(1EyLRLL1kTml
z0)7V4AKw-)*2oJ(8(`y#&x<Br#Fuq<oZH$tI}x#@auGkofpI3epAmX__w&5cLJjMQ
z_b(|#>wS9`22q^9<*6GledV?7(yF$3aNF(Sdmoa;V0ppweS7y^m=*eugw7<FY4M0!
zYbEbMBoPidop6T$_5!f*?Q!X|i9iW|17h~{8s2iJTw-RaQqpT&q1&NSc@N)0DaEe#
zc&owWT<9_EZA+}3uzkpft>+n)k`PS8hYyp+WXpc%30AL8I<8xFNl9%AXsM@tAN46J
z?`kKl`#K9cFXQKYGq3!Fh4TFjlDnchZ;b2l6{Ba4lou}pn}e2pXZEJ~rrcZVsRqF&
zksPl#qU#6K<}@guKVT>!0&Sb%PiZfHUD|ZZ7wIh#|7u#tFO&@SjeEy5I}5{=#s|D-
z1j@hYOTAYosvTHXBH^J3{vyj)g8VRw!`q@y%9Hb&<`YAK@0w6Nck{8Vma7bQ8nI4O
z<~>r8g!ola<91y3q-u8)PUD$+0)55nc*!#F8HLJ25NrBQ&!&QAU`rUc>C0X_B>a`W
z{x|y_KCPmtRLK*!aqdk_B$6X_ow-w?*+{$Giynt4UiYE3WvQ*0iAbq!l__Pt52FOP
zzU3_HdYK|6dk>C>Xsrk9nwA?kEHK0x|8Zr@!C!Q+`=bsZXqoU{o`Of6rPJ!L>#|9P
zh@O=l1#j%o&?Qh_9d=z{=ut51AS4?Smx88~<hNPI3>5FZ{3JV$d{T3EPOz7J9=@ON
zjr;$&estB2XLlo%sI4DJJKF+3t#^8I(jh2cVISW(gpgaXdZJRsz$eSShyeYUYYj-B
ze?Uh*VKT|2uUjbUAXdqe5eroze2?+B=JpjduW@_v6Iw6Z2G#Q(j6P3;kT#awzoCdt
zm&k1wNNs(w2LF8+I*z~ND~_|AsZ8;b1734D$jpCo0>jG+9d~hg)flxBGel)vXRw0*
z_m7AzwH(K@o!GUN9|L+hbGF@71LH1_Ds#`G!B@k1<t~*FaR=W_zCR4MQW<yO;EAU#
zf;v0b##y{pa6(2jbJ=F$twz3c!Na2-y79W(Od^X|y7NVdv>+(m+vGQc#p+xIOj;mX
z6jMK6Qs~01>0fSsMTf4E{JDG8T6ZQ2qzpZ0iHs=+F-;=sq1DcW)-inkm?zYaNTmSW
zy%Y-Bk37y*@f17TNKAp25XZL4!}rqBH*K|2iJ|k4zic{0S23Pi+<}3|yZQ15iC55X
zFQ6~HmBWio^kzj|7<V`BY79}*9QFokC%HT+rn-f3tgg5Wc306-bJ;`2>{gVI<h)Kh
zPxvjxQ_bTit>k}*f_i*0>}<dUD8t9c2c3O!MjSzZHm?>Lwrjr2Orf&m=DkY}_;On@
z2UV{KAC49hqYt9%?aiI)6cKW{*Ljt<#Q=*6-FC8o9+t8wc|MX<F736h@Jb&g^0(>v
z@A{S=<$Y+mUUD6<Bx`wQ7eL@fR93i3HB46}RmZRAyNeE!I;=<v-`P%g_#DhD-nDj$
zj6UnQ5WjP;q%3rm4=mVi+HlTMaqT>aC<*82n>TuXz%f8*QpNH6j;}xZ-?&H(11fjq
z%E~N9=`N?ho#togucj#OCPA8F=VTC1pW@)G)dC7K{0Hfa5qB_kj=Nnfyr8*S_R3eR
zQQF16kg3e%o}8bIStR13L~jxEOe!;&H!!8-owPj*C0G^Hs$OKfOOZUkW|Ts6&I_@|
z-DdwbvcZ9D$1q=<s0H&<0Hw+#<GcjO2pu#(XwC$42gvXoryv$Qk06p9M^9cEGDz+6
zGtlce7iu}BQsdLzpp0=CO|4~c{pO<<{o)tbbv*a|+a2&4rtj<fS3sHIaazl0gx$?Y
zkYkY0x=rMS{$J5REpYlY!N!JTdq3(c1jA+eNJ;uH9^I^5Md(GnB6*Rs&a&Jb^h>1O
zp##ej?1cCp$A5$WkS3eS9%F&;p31BF8xa&}L^)x!>Ll?^Nmt<EZfC8dc%dFqw~oTy
zgTOQ$LP!&XH~8EHSo2$6|HNg_P7fe&{|?wIxXWJP`Dvoo9*oE8Xb{h@?(Hc8f(Q1E
zJi)ECifd6QjdrHm2>=`B9WK((XVtT}8y}krh}=KteYxZ*zQ*F75INzg*$|$j5;}F<
zlUMXG3jVphQDST9-Rx}C#p3Nw7KwrGZz2b2jjZn>G^%1ZzaTVzBk}>J5zjGBVE@;I
zkVz_zacXk~mO&FN=P(Og-@UA@&3<#f_1yhN%R$MVKkibFvaZKq`DuoFSCC&wStrCR
z*XdboTQkC@$b1^Na0kJGmp)5bIEdkphHR3C;vcA}y@=#Gzr~5|4;eq1gNLgJI<V#H
zqPks2_T?ZN5R)K)9!JNJ`mCQ-FP3Tsxv{Gp{z_fA%2dLVLt&qAA!7XX1*xrp0@N$$
zh`fJdSD9(*{&l=%M{9FgZd(@dyDHhBmjK|~6IsK89A|!Bt1aKR`$%AuQ8HM0*};qA
zjHJ~6&=T(Csh8NGa3e8YdV+YaFxy3TYa!YaV`P94gheT?L(P0)ok@rggE$B>>08=m
z4-=`Z?@u$f@qB;*m8&QFG4pI%jgY9uW88`^2pmL*+GVf5@7yRs9Km>pS@{uLt-UJa
zEkKRRzsm4Ns#&xB`1t2`D7tb1ozUL9o$e*wf>M4-K1Qs~0-x!=y|@sDk`<Zzj4Y`x
zGqPV0xhs;y1z?QX;!c#5^j%k5WsDlbO-!fBb9Q_}oZ9+cLStr*lJ*$bUu#y(Tfr1#
zcpV7WFo5yEY8*(oY8MV|iMy3%Ouq%If#uup{^1SyFEy`w5o>fZNp|k{;!6JbUOGmS
z_MP@vL5m+(EH?{pttT4mWDx$9=`+DFMuJU)!rk)n?@Q%7m%E`t%yNrMnEeaFyvMk=
zwog%_*Q?f$*4OQcV>S*1WSI|?uCi2nkeeXkeEV&hn<(MJBSM7REE<UzB4!yvi5NPz
zMsA?Dyc}rsdl9vpV|G3T&YiD+=FYeAGThtzDADmt-%%Yc)##w7l9*{}B=?#3<m>ho
z_-FrIYaN4-7YujK8+Xow-)J4jc(c`w=SR^anVe3_&{{9j;^NT}KP3WaZ1qgJc$vXK
z^pe7xZ)xdT{;z_PO`dUzMwE@K36<5BP@`&KwS*ZdL$DSNb>yNNF7wRZhi`*tbGdC5
zk4%9A7AOCdHPP3}ZARy}zY}Y$>uGNSI`fpbNp2!K3&t0XO(W`ib7*4psNcsu|C<&V
zP)SNyn%4y7BZwhr@<ouKkasV8tF_F#V;FT%l_d~#D{r`2fPh&Pj^~eh-M4IDxPRQT
z6lF1_R&dum!{JO-?Uf-`YTg33p?k)qC{l;VL?nOF<+t|{Z?;%$9LO#cF?SNNu07Ms
zkpJZC>q{2__yr(4Q5S)ba!h(O<1u`{(>)+3?^ia6GO-Izpi;dcb^NQ+QF-*eL*P%;
zC{*NH&x}#$NoiwvL}+LCg(f%gG@{D19Q3hTGvh-=|5YE*+lu4;thVjZN`BQfE~RMY
z&~+HYLpjaF(qw(+kq=G$T~EaMQ1~4q^5(*3q40F{jpwp#q$mi0G2rqs6kAB{usA@a
z>jOa)2+?Cu2a!xd>g9jI;s2}9$-l|~UkfAd4*?fUA_{y*@s5PkintQ0l`y8tpsX^+
z&I_yui!olcpzLx#jbq_PiOM62_n!;wF>BvnbpktLbaD}_=0h3wz)OO;qcucWKTZ^x
zzJ=ocUqCuRW!FdqrCM7L1PogzG{x^W<(DhT4P~~fW{lXlyZTuXe^n_)(Ut<9<f+p3
zl-7|`O=^sBDf%Lw8~U{~&f1}TV@C{ytYyq|DgGx_y%-~oM)$u)5A^os@$bUg;)P4I
zw}|Lf0Ria2V?v4)=fh|7Kv~Vb&9%sJi66xKE9jl>jtV9KWrs;s0>I>1B9FhrajSR)
z>&>p>dqGdG&%LAxGCq3pve?W9%$go3WHvsQNaz6=lo9+Jv>$&EoTK_mP)ul^6Zw86
zG-PI{_sN2!{N<r(ncR@w0h;D^BS>uDAsP(No>sS{|J;pYi(+6eVV)B3Tiwt8aT`D?
zHk;vfTfDS^AG595El`?l;)!jCGG#B{k!zA?k`e!!@SY<(7(!<~P#;ghm-GZQ{^yRW
z2rLl5$eW-nXw#cq)o5*-NIBQqI6L<gWi!i?tu=RXMHEB{w|{l;MxkN1O)_efOunl7
zL*Ln8)HeD}NN0ZhHWOg5&Q4^J{tDp7e*{p2Qp<}n>WwIpfDKOwCV?V%{b!WbIakkm
zUNATOa1q}8za|R)#e(No|Jo8ntk+Hvcv+gSPW-F4KRzz*%8z?mlvcV(wmKj}BAir(
zMGR06M7=$3BsczG)Rv~azik60j;4=hOj%)wM=Kav{yiL$SJKN!7`w_5G}JPID6lvK
za$KFm2?=!&_+`RSmieDU(-*#+NW5BK$I(^Y^Ygn>+4Z}lQx97a23$#oxBt6T-U@lj
zeBI=DuYEyFWLU7<iC|=R+>Q{m*gQ3yl9PFCIXlPBshO#k-RbYS@P(}wM4<{a5$#p7
zKK>BuiD&xW36Rha?b0V4xYLUN#ub6dBklV`I+m~l7BcE$(^b3kvDajki|!y{_ro3N
zo~J?QYvyhV#y}9@DS~hIecsuN#IUL#tnXN7&Uc+T&*rm=nL0m3So*;Nx}HEv>t7c|
zM_GW~AfW5S^wAe%w%`w!kMTFHPal4!)Vz$slY{&3(IWzD#@Y`<J(z)Se{6|*T@^*^
zTJf#Xf4(`ncgay4-<PX3n4kj+j0NP=7F!bDKUi~`o9Bf)7%;4yJ`6E>wD44Y`^L{Q
z&Q>M-SBnC{%0{M^RkA22wgx=N?VoUOP$qtDx}`d(ZG8Qzu5$Sw3)67AjpWI{&+T5D
z>GX3={ZMFkz7E;fMdGJu4u|HWX4{C=%LEmy-Nv(gAxi?-*Qu|WTd!J@P8*4zuGpaA
zK~eM7T`p5?-EUy%K@C{S0}^!|=R}jP<%$!ZXqln9<LOF`$tnz?r!Wy)f(JlKL&bsG
z&oB<>(cD_g!H;DD<OAtiy@}#sA<;{>FVvJ(8s~fgV<P*QUS)g5*yywXt5s^hg<s_9
zSyCudC|}q*VcLEN+SekU*JGisHO9*wtqn89{52ir_)n&z9mNQ0CvS#g-_qX$>7Vk%
zUh4`*w1_}bJ-kU5R>18daE-z%9}Dhk2f$}gicIOoSZ_{eX-EsqH>SKN0vg9%ikm#0
zW_^<%4NbDiZ{u%rHx&%X0L}|fTW?9V{SeOKCKsf;*Uv~?=%tIWsTo_2x3h7{2E?uP
zFAKCqUx~Z@d{uyC=LD7kQ`MoRbH#%V1Gm;f{-B`XueX&*l1z|8*)*s}O0*LHuW{AT
z|9K&u;i}v$k#;wGOS$W6ynQdj3)j48@0#&wm=sW4+6s>fI2-{sSm?zGwBG!3Fm<wI
zzYDksqtNxMl7lj5FH7`HcK*L)@KVEiQC@|2QK!LU6|B0>sxl60w-92}YtV{S{l|bd
zocfd1xQ1@)f7Hx96u3as)b9JPb06>Lzn;r)d(zluttsGK`@fGho;ye0ZXD5g5_jK=
zWf$c_COyy4`oH2nfGSV8^jajUcc`Qu_nxoMcbrLH&lY0LqOVc(l!f-k3~K$aK}`AV
z)-J6RU}Mw(ggUKljh|6?OH{F*9B?2s_r4a7Y^u)bQPC9<0w7De=|j;EHmpo~1c>z%
z{Y@Wp6~GHwS)QQmA9-$<k~30&RXqlKuQ5h6BG(Z9+g?>6tjNk*w@UWI;`JGTxTQ2C
zlXobZ<LVTYqbwjDnK*81BrY*!UY=We428o`5Kv!Q*;j6RyD75h=x+&2k821k^0i;V
zLYm&Hog2I51B721$3+{apPY121rgoU1tZQ=+Xl-!KO1KPs}Y=b#$XqaHIVeeQ-6hf
zhP8j2&&)+HuP0b7Yl*D8OBv#khl29O&^DIaj1wJ{4<MAb0@$qIP>HkLk|FdIoPkhL
zJ(1i}#OV&rDroe~%4a@aT3cSGN=k>LVra0ZCsLX6+}_A7)e{xy$(gg-sCiPXV!wVd
zxOl+w1#3lBaE5L<ha;NV;jz;(yT3?+1xU88ADXM#)!&;Zq@t%}IE;d3KA|4&Q3i>p
z1w7}KK<$2D#9{8$Y6@z4J<Qw>tY^pq!3ScUVwVXdSY&7A5lnKXpm;7(y$LJ2uj&7$
zD9Dmmqg*$M_oBwVZnD)>a%`--V@=6A31hl+&$W5uH8j4o`o(quRH#f!n{6PQJZMNO
zw)v(0_!$~#BA}hE5ad5}XywChJ!}|=@ur{uCmPOh6s|2&<#$k6Km^yNL+odQpg3Sg
z*i0N9)bn5Vc)hR{p-ae7H!fO)(9`Y03eR<6!Zqhgfw)BB#ZBv*&&p)x!o8TLQY%}L
z@_Yq-6-D{1MpNK!#^@rl?&Kp2O90k@S%z*K!pea4USOoP);6kamN>&uj&)F--a$nJ
zwNw&VsND~I=v;@tF!zHMh4yC@Xx$z98dF@Z3fPVc{*Taz3*|4RfWK&>eiWy-Tz)&3
z**1waBW`Z2f~lDKeOT;Er?*&@7(mU}vwXb@fD%{H<mOC>@aGq6@Aj!8o+~5=w2ElE
zqJerSkG_8>pr>l1a=6N`x*|Jt*7tUMP9+^<O*~1WDIfs7{7u*C<gu*vqtfpjWA3DF
zfhUyPyUFUz*x<qNJ{E$`kq^K)f|dc$%B4WTy<edanyr_=xdKlM3z*oSVaQwOd$_1z
zDz%NPj{Sg21$wg;-&3$*i3&a3?B7h}ID5i&10IrQRU&iQ1OW?volLTbs6rV*|I3$%
z>H~Gm^Do87{v^=}&pwYBQb0tuhC+@XzO%`$OGR)+5GTkC1#ffA*>Hq=*YW35T&(E#
zzR*@1x58!ixg$aY1<C*A)u}jYBIy9fn><`5$0=ph90`vbl{}Qf`FtNetX=2dBob^z
zO{+UJh)uF>;*q)HSYoCv3dNp5u%i3yEj$!sL{9_h0LvURQxIrz<QS*M3XDnVhivm5
zO?NuR4CxheKlK$nAu`WvMHC)3!c?(Fi{VPeIy=Y9wzN8A#muSfxQ%gTN^r}6WC*<j
z+0qgwA)jnxOl^h<=s6Q4wGk+nyB$efmwipQNV1FnN?zt5#%G26VvTD|0<7L31!DtL
zEbxgK0I)YKFeAsTKNKGDreK*+g~dxMKN}7sNgQU@x?V!nfwO^+(xmwqCCc<6Ew)me
zYeU$ZnD-%;oI&i19hx%*C^UhT#{Ur_iO7!|xTPHV4SJ|)iTd7&K~&U%AssS|PpHFr
zWM5Ct*Tf@pxRS5lZ$TuL9ACx2JlgJ1LG@wnY!Z~jRBcADIo5k35S_<SP;2whq(#$J
zU|`zN2O$BJY%+zpS8N%1&-MQhYl_hL?cb{+)iEwSBQB7~mWCH=`VTWOyr>S~=;Xba
z9tQe{KMdr&Vr*{=fNpyVS1ShuPucylf=e#_{wKwLF8s#3P)JZ&J+E)_p}c<_C6&<0
z31hP;dj!zulaO{cAuzDf$Fd(G1Y)QY9fN{qj*5ma-^OjJyVWj<2}7ROpmiqOF`0cJ
zS4&t4u33A!kr1qFlxeb|MkPN+$Eidg?5%wOUDKHOlbdzXZDNqvk$|`-<J^0!T`Ai3
zIN)TJ-cp<<+1pVG@PbC+=k180&{R>d?a=L{ICLCfE_--8y#AqC9aI#w&_nRtlRex6
z>`J|jfMT6!m5ME^?+YjKhXW~j$OT?3newl-#ga^axBd%>?yaABZ*dUV%uWj?^it6z
zhYdp6g}EZ6CQ~i(#Z5?L?<QEX?F>HqQ*$ar_&yo#r8{bYyb)COggQr)vJ9{$oYh`H
zKq-Mj3({o24Y#@Em)K~<XNHiS_K(1uV7n5gcC9xFr}B1Z>4n@18fUL%pmw^nAS)1c
zQAkCxLr@9;7|eedf$?J%8YW*PSl&NOfqBBI7M;Gi%Yd13&-O?87I~ZmO}6&z8hB2z
z#yzOO@1stSpCKWTeR3;;2&3x-4ShpR&eQ;4J5fI1xZd~@#U?DRP44Z}NOXpma-#%>
zT`btLC!W4(Qxrui3bhP!{iZc!?6X?=B#zQ$Qxt*xNS?Fh2z2_G?}E%gUkYJ?yjOqF
z=}gI0_NykzLnO33i2{VP@cw!0j{8!wM0iQ(>Fb9PJXv@~hU##LjDQd*v7Q*O{1wkh
zJAj&*r_{-|@gnBA#Fy`(4P*VmgHfAiYn%uA9AlTCv7M2C$Tk*#lNmU@xhx4d9qs9K
z@v8%ZNf_hAX~nv9YF^+U3rkpTR1zNY%jI$p4xwDPiW|?M$E|^fy_R?v+3{-WRcY6I
zJUs)#wf>ztC^Ma(`4>>)JJQiSnn_Mi{Xj}pm96E}3Bm6uuc)eQv9V(Wx8cY58ZNK;
z`+`DRRS6_x%drmN+Tqy)0$BDb%Mut$4*enNN|X_3Bg?~gIm^!!sjpGe;JA%P72gas
z*6948w$jpOVsQv7sy+vEhqb8zc_onUmBxwn<2XQ5o8T#7&Gcqrjzhm{G*k!o^B0h6
zG5bq(AI7W(P!LR#_UL<&wBk7D`YUg@5l=}lx_%(O4YBoe-PzgkV;zG#qxKE4eLV4O
zq~BR|c61F^)YG2tJB`Jk)K$&ssCMK?4B<M6XE8otWtW^We1%|I_}BY6Ar)<y-7DT|
zBC4_=<@4jSs0xMTvuaj?%~H>{Z6d~rq#E9Dfa_bge70Fc)&uBjWQ4;?s$8^X*nYFs
z#l9L{6tB@2F>r`Su9@itn%D?YB^I;TZ{d)nIr0}tY?FQ(!PnF=prGyEM+%9%745)-
zX6+dnN-dXhPoZtQBx#k~1Pi^-`Qx&H8F@u#8TOL(?RrVS#Cb>`BpcW((9S-_U$6*O
zNV!`01(8f)*6iJW!Ov`~45*E)n%bYvH`<aqgkrq&7B`e0fxdp&AP@+PnZ*%|gFUhD
zC@$;hH~yn#L5#MCIIN2b-o#GmV<SLInkbu_gx07LooK5H#j|^I41MYReXKXn0T6IF
zztlGAkPaz{$((mt1%3vFeuw8^ac=jUDaDDWMF(nYNTs0hKzYL0KVV7jR3=B4=RmAR
z%P-!+mIUc}K(1;HNkJ6vX(>tf6&UQmG^(ch1b1gU#KKXZ$1;2+lsOn$Qz4`TmMUR`
z6ZhR9Rwkg6H{}nc3_I>ZM_|>==_gMTBp#^U^UwU0nZl5$i9d?^48Yqb;pZg7^difc
zl{%ppmvsQWC(Ho4|3s5eo^V-3jt##07VQ<BAx3&wNT3$J!<+L$DUffL^-g@id0*xT
zNO1xu{EI3q$&e7<p!uHn(&q7r2RRxo{S4HGa-8c38uZ=PBFfN+Rz*V;xI?e}Dvc7w
zo_@>=iG_7k-<bSv93xtAKej{s>6N<{o&-{Z+;F@kS%9GRvv7O`US0g~E=(nXw~={q
z4?k9}Jc~NxZjB<S;euq)DOkg@dM#N%xKA9y`KV7hz-h`8f(-%#>xt`^8xiVFBuOL{
zdBy3~2pu=HHB($)5aR+zO=I3Y2C8*GDoVdm58KCkV*^}EKbk|z6sxl?m~UW0t7ZAg
zJTy>QA--h}O{6lsAQCg}&c--&0~0sDM!KYAk5Mmunff^c%<2HPT|=SCyi3rWqCf!_
z*BcfkKiz+Sz#O`WO;o1(Td|xbN^MaGL^9K7J@_q@6}Zxw;HoDt{Si<9=tl^FY(4K&
z8jI3l)y}+1MEZE%JBE^eWCcug(No?+prG)k#XB-6k>V6>UiF|r33Y)5OiOxf&-oTT
zSdv3Q2_SqLSN`fw1~rdDH)!ZZ96i+t&l5AaKFU)LoHEl$di3Q`M^NB&l3Y^djF8jN
z(Awk&-HWbe0RvqHtcLd^!`5|33!hj}+Es$SlAfZ4$!pR)nR^Ja(a{1fPi0ZKptYE5
z9?klis3z(DFd|?rU?m>tz!638AH^wmjtf;|-dJqAeo90gF~n5e3@JMvCSVb7>COlh
zk_HQweXsed)$|4`hyeP~eJvj_r(ejcI>re>`G~T+6!qxRP<@ip)i)}C@x0{uulMM^
zh-8VM%0tGVr&2ma6~1@T(#C%}2@Rr6sjf*V)*nKnPszUDr#&i6t^4^BJD(YaK+7VA
zJ#aHDRTD=%O$_%Ln7_`l$7~#~hvJR4R+R(ACzd-qogfDcl+s7l!YngdFfB_v_n+uY
z^$+4XO?fX>lwgYTcesD8pq1ATDJ$<|;ObveQ6YYOq!W(iVb(>8o;ROrsiY$1>5pTH
zY1t#{M*;8qDMmIE&IxyR4dE+QGPImIWt6#0;5&#hQneul;RZesMr5jI2MF#>!;|IA
z#u!B70)Ec`H4hbd{@}`pOd45LdjQ6t$OtO!r+oCd8ZSvn6s$Bd+h=quuPH`j*)qR6
zUE>nE+>2aeI~avqBURBF!i&Dy5PqX5AQ8!>V|n7OS^~I509hI31Cfgwj7q-6Mh(97
zbr%7v+C#J}kuDGs>MkA0lolTh02cKdnvVUi%e+7zMUooP1}vB~-<@A9_GrSAIfbga
z1})A^EJfajDs~5h4bOtn0J_Sk);DQ(Y!k>6AOgWg_m^ouqL8Erfdw7FVhO^$ENH$T
zc4Jzc!q3bVEJS{4AUN|`J_SoQ&usJjX~g+Q{O-h7u82Q(3oqxr48$Gz$+Bzry<$?V
z{bR<D2nseaBTHtkfO^7oN|fJsg_cgEAOkq0TkRI)CSoeHqgYN2y6*32_=>~trGWzh
z>}bqn-VZgPH}6G9eiaFQodN~Rdp8U>4gx-dR4lysKIuuDh_vTJA|fz?F(yMHvan)S
z528?2J+`gO{Cm|h8L1iS5OH1&S`@67UsUYy)ICqC!8U>P9b084hl(vQq`i(ANQ(Z$
z&RzUuUgB|(VkkuT>!}NOnIi15+^0{lUxiMmsJd_w%Jp<{c;Hz#@_mNkLe;z0i-HE-
zT|uJg;O35LZN+UmS(|k)^<LVHbBOKlH*`8z9up|#hQ5*f|6yQ)ig-zq!u(bLDB6Jk
z$$0=oh-|vUK-V+t`s<5CSMZa-6R)CeY2Rv$CWMjJ3dyUARaMCfT0X1daBxL%;AI}y
zd?(&dNz1!<akWfM1KZylRA-%ErrJOoy2YmXFVonQ)2_$p>|RQZRmMSWCm(8Rgz^s$
zoQkVW^W~jGvy~}jT|LNrRak(=B1>qsEPcx}aZ?G)s@$Dh664_L)QrijLQuEf_&%0+
zHhnCMTZ~RtJ+&vIR<}^db=<&$0w!=!5UzOJjnEUK^}9r0VuS91*k~bQy@DzIg=2H=
z9M_1w&QZ@%&h339_tsr(v_85=BnFZXMMB1FZ?_O_rJ}+z8ZDV$g-u|Z!$sp(Nx`l3
znSzq^avf6}mv&<k5E76#)6e25vy2(zXiYy;ZvLD7OGCS}zdwYs?&Y#3_PtNLcPCyt
z*MjXhj@K1k+nxIiT1^Wt>BXxMq5?TZqG#wTMK?6N*n1U0Z;kcWE-Ms491)@H@Uef8
zjR&p$6R;)P^-b^^Y9%bGyvQZ-nN=JfgB{jA3nj6ogOU;d$^03;bkIsl(i1P`zbk()
z)LPV2U2_`Ry9+>XCgB+&I>2qLy(M^_SkY2JNRzlm<k3Ta!7uh)jB(-6c@4=T0ui|M
zw`BjeP<$Ipnmj739=&vk%$C(Ex%wcjxtox)_0oW`iWMMsVU1^co&)=(f4G94ZB2et
z`F9gX1D%kTwcFt59R-`|9TIR=Vn`SHP_X)96t2P(`&;4vt?rs`wGol&1u;NshWG<&
ztUZD&b@S^={z<86!iBfAO(P<x5gYvanh9nzr@$UlSie*xMj_iUx0w8So46`$aUq`W
z<Jd?IXn+{m(^4j&bAj{h4#_=aQ5iQ1FKQ#hEl+7@NpBM^bmFOq32}i7hq;uWiBoGO
zf|;L*LE0|}7G7!4vc|Me&VOQTSsoY(qV1Jck@;Ka9m&e@OjEd$?4?pva!h%FD-ARS
zFh?MK0FoA!3ATJ_^yY7_4pms485N#9gE7|MkJ`k*s0A8)SiPu?tj?CUf%cP@VSKbg
zu?GzN{%1|LQsQcS5#;-1L3^Z<n93&Gc%3AY5q6C$jA3i7PceJ<fBz?bl(-e7?0V%q
z+f{Djg{65dZlnkl5`%cDsuH|83b2LXnB{t^B*NTQ5&eYUJ|9R7*~dp={x{7{Pvf}C
zM8N-gZ9B$9&lM%~H6X<3>mV|@UKTWCB@|+~8s~tyPHH6_j~<j_hYPlu03Z~F$9np4
zT7)3?y_hfl=u&J=(O2SJ<=~7gX`lpB*2iu_#q@^tf3FHVv!K8<I(VPbk*n})I;0J^
z*50F|k~P1M{@0437-@b;Hzige*jb!b-E|h5VN#5+=cfNiD*7qzU45!Su&X|`ns~7d
z6@GYj|37L&8W#W5hNS66-3y)KL#x?OBLByhw&<;xt=O%&t??~Mc1#<m*2*|ba6#oe
zud4$vS|v~+MqiJ(6NWzeY~?Ge(k-q5Z-DpFqAi096TjQX_|c@3)l-=CU0+xbp@P((
za?`yqbBiX*j^;Itr=FKrERDt5qDQ4XV`l@E?0+Kuo)zyIaNWHXF<P^OrDAlk0*w4e
zAMw~8RlNI04Ya@(+giWK3-U`sQifXks2C9}sV9lVaLe&t>?S8H!HfM<=BaD;aJd(3
zt?RKpw@Ko%G&gsK0d>PznvbYSNgjtD4{6A0SZM@l6h31C_U0~boALA$p9DzsHY+q4
ztAM;aa7ce|lqseIi|#t~CT-76>rl2zR<-b-w8zucX_4%Id;l*kZ-2Ncv(nK{y~o0q
z7FQfW7(pIEAHf>I@m|haT4g<`_<E+EY8GYP@F>-oX*LO@vn^$l-tF`Zrj~mhx{SWh
zuLJVhhGHy~Fb&#}Bcyifk#rQdW<1n_7iwikWgHVq2Y}-O+S2q=JqIEsc23ACrt-w5
zc4j!vEN`&7rbf(2tS(^HubfBmGumn*%vn}sbN%i~eAyjQF?{{_g%&n&vg1?fp65O_
z008z^)H&1a$A!(&04x5m)Pna9pxqU!zBW}-y^|dicP=e$;WbKw62R^l`M);xk-Q-^
z(I2s$RU5|{A>eYSHzVJX*TGvG{7k(EmodYfIr#b@?~-k4Y8$OJujgQzYU!su-9IX<
zOW?SjAO27%6^&2u``54YZ$m>7{xNX2Qg7FL=ol;HOz=)&Tp%V$ow4rb>j?Ug{R?>t
zyeIc077G{#*T}D*J+dC$dt`4+_XT0CX5oI}_xft`D-WG1%i7Q!>0h;lrRFsyxAc$F
zJc_!~OQm=!UG|z&Lw6$E!Nnw2IgmI0HcT^5FD5~UgUlMQkRHzuHyzWp-`+oUWe6d#
zuKJ(XGi-hzp|SKxN^)V`vcs@1;v!irrpa+FW3!l{r8!wVzB?v85j@d7@%eWR;I(e|
zUH7$Q8e1BVCQti|mb?$00xaYFX`N#u`JXc%Qg3*KlMXFinwmjP%I=?K7-I;od0JTW
z-#40<{{H>j&uiW&+*XrTC9>$Zpq_5RN_Oj)5UJPSswKG<hwN&-Ir5$iO9ANNv<5wd
zotVQAt@@@hqNHa2&AoYb{=2Wt1vkN+rCma=gC}$D=xq+qM&5kjx8csdKQt!hcW3df
z?VqVdBx%y(Z}aunT<VqYg#-*7+P_Esg5L^jdbvk&{(eg1++*Wxy8!9)1jnDYwqbAy
z=6^oz<gVj4;&1fdqde&>$%g#NCFbNMg)4u6+SJly9ZB}`D!Jx@xKRP%*Y@BW8XM#7
z78*9yXrgS)&CFhJ>}-TtzE6B}jJW^0p>USSo!=YlZ46_tEM){IFwUETYV_)``U}*_
zIkFj)EntUA_S#9<?0L2XvhXd-!S(rb*r)_3bp6n`E59Q}mVf(;{fn)EFVlxJKCLcy
z%CBsewY8gyLzXrFM5;L9c+0J_B7Vm<0GTL%3o?&AC*sp$NB)_`_D1pVeogXYA?Y->
zI$EQLV<9<!Vqm}OJF+idzI<jpT<;yKGwKVwJr;CCxY+WDi2X336-5~aUM5-V?2vp1
z<*OCIfB^45Ns7D8><UtteZ#WIE5~bkFR$4TyQeqs{8wL&sPQG$9kJ-rC_gC?wMFFQ
z-U}!i)TiTD!`}4WD!Vn6*Few>ZCbwO&>U)f2AZO7UUH=#+PWZ;X^u)rgqDj5`u}Ss
zymJhf4V59k6HzRUIDx^=cSPY7ejXI85jHQ^&S}PR+$noW2*_sWE=X+E*2_Gq<L5JR
zD}AM%J|&8Rb&gZrE3juXbMb46N9oL9h=(KY1lG}51l;wjT{q(el_C%6gUlC9)68&i
z0>^TaVrtsTKfe#}T&idGXB0&wj7G>0B5)dF#|SY3{bO<b!^_n9)W4toM)-|LAeSbR
zCX=QtXrNcL@Q%;C|4qil0z|v5LZ$KS3eV-ZQlWf#+knxz-}uA)r2zl-!?)?v3diZz
zDe!LEpR`J5qkRDQzdR}{D@&k-a$U{paO-+K&Qd#ZUHs`~+K&kERo>^k=F)Ovc=X)q
zfuH~Qi#^S<0WOPp!fP__@a0=8g!|K5e6Nc{)SBj5y!9W-S=PZnMlXyB?9}RT4LO+c
zpXDq5Yh@4Z!aYN-)n<$u%7<%M$V-(7I+eb}`$`0N8f-bA)E_Gtp&oGf$jKgxIK6m%
zaQ~XjbCyx_x_A3Y9<Wi`e>9kVM`MlPwRU|>j0Gq(mVQc7=>nFgyf+o;P03}dU6FvW
zfl|7BmMH1L>>P{!x>%!f`5&h1Y3CcXn-81#WVAt_zpx&|!g#jp#x6Q(?&3P=9ZDhJ
z6MsZM`Ia;WpF=}oBmEP>@{x;C@?w0=PK8@ceK456%bscDCgL#jx>Nxix-P6dnjgpG
zD_RQO*{XO)NcL3pqvqjpCnu1|l9%ilI-4Pez@liMoM;me&nY3s5#GF3e8E^m!f+@4
zg>BRo^%HFUFiIx=CXhT!TeQ)it>ClFh)a`D%EJF>E-l5Q+@tW4=-lUngi-%S{*C%O
zTF9S0m%Wy~%Ogk4bnp9eNe7Y!8qIOmxQ4TB(Zu<v88B>zdFf}4N#=Q?Q_~vyngIyy
zh?98%m}DxY6m#D&_;H;|6>(FjLe@0>Q$Urc0Wj~|7<ON0$(=~^#EuEU6cqxnVl!EC
zl?t$1B*`8>+Y4i)JJ|bX!qqm-FzoWJ(pkvx;j-L=6UHL62dB_Ov(gyS*e>|w(v;IQ
z(+mWCU!IhGQdZrt=yZ=HI&Lb?{K8#OZXKn!Lv41k>T{#4WT2@NGV>2zcUz=iBomFk
ze`0yT#dXG+Q#%_NfXtfsR^XqY06w6rJt^IxGE-MYwlwDbF9==aP^o!!3B}{0hQ;Cm
zxvfv9FlhQ=#s4nW*}iwd9qKy%$|x#H#93(saC)_XoDEEsqW#Pf$ha`oppgI>GFFzY
z-bB=7-n22<x}xxOj%miaHpyuTJzbs{YVM%=fzaDa?=v4%1QZ;s9thh%DHFhxXIDwC
z24j7)E3y{3PQUPW`=k&<OWmlSrr>K)T@bn#?JA18T&lKSzk{{gC#X=ZcyX2MFUf#D
z=haUz)jLh&|69M`r>DK1CGm+rX%>RM4P2MIj;s^LXWDcjyisnSnAXl40g|qH2EtOK
zWTTLPheJw2Qj#-0fh4!Hv$OY!AZjQOvWbL5g?mK4DD?cK8t%2kb=9;>sl7RkXV|WN
zu)^?iTqS`Jz{oJA6}Mp1eJ}f2Q9DP)JFbHIg0=_tr+2XldKzE-f(-udBhu%|<dHtI
z$327O4rB~_CkPqPQOMLmaBZxe=JjiQG5X0<rionm^xpLfZtNtb$Fh2VrPJUQ(NpdJ
zgWYj`X0F+4S(g}5MEs<csPb?^LsE&kp}Wg}1bxM+b2N%9bIpqAwF3PM@Sw2A!w+n;
z>JN98$vCL6qD$V-t{sO<qJC@>6Wl_zpRbYQ{Elyfeu4Zw8E7<X7bW|)s*C&dGqxa9
zkxG)Et#3bcx?uoAKkk|<Z$sUAT0i1*Td!*UVExV?0<;<Sr*ISgC0dY>!=BxL|2pJ4
z)N^o(o{2<XyNP$$%bI9Tnt02%8J5DWJ<@Tbr>PUV_7Bl~e0&}00(zmX7tIivKc27<
zDWE$4kg#OC=PFX8ci%2{u(uU!zlB3L1uMQJ4c%+kQ-6m4+`FKudTx(5hn}=$m=C(e
zC#cArH<(YE<xgA9d9xqSQ4uwB;O}bqnQT01g@Bd;@S+R6=jq?h=Pnwwg|^B{?z;TA
z$_JvI%Uv`PJLc^hD&xz$fj5MVb;E@#vn6)U7o9#5J*(hEwvy0tnTL^J>@%dZuQ|$<
zGk0FhQWsRNolaG5)*I^~XBYO178H0kOFQxew#Lf1_Koa<fDjjKBuHRhZ{>%R-y8*F
z311o9k;_Emvy5p3Z7b46AiY?2xLOOR7@jgUGdn1rZvX<Et@2z83v+Ysudj1zG_bjt
zJ{l1A;3+7E1^PJ6hgg14uT@5}*I|T~uULamo2%!XiMt3;3)GcpQ8XzXpAp1V?`^tn
zc$$PZ|M6a4;_k4>ui)vbX`yePIwKf=bCQ6peR5k4CtUh5(n0RlZNXsrwlby3YfM$~
zi}wnVHf_fj2cc1xc}XB-T%4IRW$5Lye;UUVyZ!Gt-v7gif7Hje0b6xr|14JgBpgGa
zMYup!0bOsWU{nbCK~#q9BDwOQw*q(wMux@2JTG>1B3FmEXkABY4&Sc*#G>O@ez^65
zV>)OH11SYsIeb|)+$DO?yus>G_p01G8rMM6itX+Dhr#a=Oi;XXWV{xTlIyoI&JUV9
zy(J6y{&T@Ig<G$<jn;p!Yy2#W6AfbQN%Q3L!!K%$aQovGgDDt}OJ;px&ryCgYu&iB
zL`PEASLTztEi0{mvGz8j)tD>R-@B%=_S;x0r&1AwNfhBqN&0I9_srP<l>N_8t|z<k
zvf;!08R{AOSxl)SH#L--fL4G1%I_H<#d?Fa4#lyE*iKoW^|W3C7D6?zUyfiPQobtL
z=^0MU%Y)~1pX`Q5Mn=pB4sx=yeW9(FMK8}Ra%x{zIHl$<hGCE#_6^5UoVLB=N&OL-
zOm0E6aH~#<cC|jq0C$S^hFI(4NXNyF(AaBM(>m5BO|$F8Gq0u4TZbdgOD2W$e7%l#
zyH059zLm_}cv~gj?rEvLL9Inzw*F>b_V0|^*p9;nJ%ochBw>YgxzfGSuSfb;l{5)3
zDZ{m(p9M?)=MxkD)<-Jc>a~93fo?=ShYRBaS_w9qqQ1GYU2}v`#iN;@zk1GQ#(SJP
zUg1kE69_73sKK@C8+2uVlDl2lU6Fv|-G9(wtBse}d2!m*GQOAe;kFk3UV*dM>y^JA
z_MeQ-Ub<HwQ|hRNL~h+-D(zgGRZm@s#ZJ~7=$(lZ>HHzs%RdwTKZ^CQIB{Z!H#$*4
zV)_Vd*I^NUFtv4g0)^(zb6ZV{kbFRrnqnoegw84C`vrTX<U>LbEs2?x{S+qN#=pXT
zm%?>)+=pd9_>+`}F)`@~BDBU~Idtfj5{S!~Ch!UWnQ$sg_Lx@Uc`ww76A`}*=)vxh
zlose<cT<)Y5W@eGva__=Z8kcrlRi!j%9O*pS{l>cxpRrYs^#xcAqxy?72KV}FY7*f
z;5aYku|lgd4q9%^jmB;t!DIiyGYGF!1$7l>s1<Day+APF^A2+rM@vbeSW)LZ<jjUD
zCxN>ty6|=Q+h;Wobf_Yp7UV(?qc3;acac+n$eQQeE<=d#Hz;1Xb58<U5VGj^$FE&u
zOVOn|)9_2kueq?KMks_!*~dLvP1j!7-b@IOk2ppq7~Yw96V1uEtc-~0?ihdTK)x3}
z$Q0V$jb`Ts-b~zyDJe55kr{ltX|#}(RoG<J`^K8~1IK5J>w^8tj7WIW0c?!H>CZjm
z5Lv<xdQC5;*aLq#b4(q2cHZh!_cd!>gT$68lQ*2UqTf(n51%@qLs^V>A1vRMj@3Ri
zhvw2$%Vg_2u>LR#lrYGGvJerH$YkE%yGKYYeM&<sQgKC=B*&30(nH+4<orZx@t)Az
zcf8dOaav`AG)+YICw<4<m%88Y&G3lV$i6j7b@|LO{S4vTZu{M6T7tIU$$;ap-<de(
z>5h6|>F<=~iOULjc!{S+Y9^1p@(ZSqsiILX9N!71dbFIrvOv$OdEl839%Gnd**U)D
zdNN9zDA7R#mR~K?i3Xiip;oqVPo}k&q)D@}Ja?E@4xM&iM*47jSX;ySeEilXg+`gZ
zvtroG<`9YBCZ@6Kx2C*Wn=BB7Hz7Xe*K|3FeT+~$Se$@bP0@H#tiyvej=|!rVa}ft
zSrTA#<F^SbpVxF<Zt;(l0+ThnSyTYt;nNCspbq8%P;<jfykjtu;?Vd<{hv2Nhum`q
zuaK&;MEiLFk?IZ&XE^B8sxe$d9Kolp$CtgBx4vw<@k9)~eV{~k^M=js&3rAIv$NND
z?<PX(+`Dq*hH(R3pL@RV)^vHvH{IB@6>)E4hV|C?^uf-4@*FR7r!4WziU%t(ab$5T
zooM>cD23HR$$`t+HI1IHvWB$DKMZR*Yf_DqGPy3G(6b7OlzSMF;2?H>nb<P^ZcQg%
zU#E3}<7=N-?a^G@@Uzm#&R7PF$WycelG197UoxVRH7swpM4XKkA24b#OifMqvy+m}
zXb7kyM-~?sUpGMxYF;wE1>$Tz7TNrzKG@Yo?l#oiXjdyjCt4kWm9xT0=IlKl{3QTF
z*KYS!NWl^qw>I}z5XglqbGfZ3P-2_+MZ+)ZX*LDzp4QDT+{YJ-o<jQEasonsG*i|O
zIehxT0<CSdsQQ}pK7@Ulajv9LuP28B>=GkMNk<Een4MS6B;SkMV1+KZcYl_z8!77g
z6Kj9vK<ak8Hts*cV6ye)CZ{T9(D)NuNw6yD?deC6GnJUZEO}gV;9-;MfI4`uuU{c0
zU&P3~Aaxt7yUSQP@bkN8LtUNYS5_IqQ{Z`YxSRAN^NvK9M3m5uRTPrdWo}_1FdOX{
zT8j6Lq9L;s12K1#lAQ>iRY~8{;sB8YU8Od(1%s6{O&~*ok{6_dXFQ-Uc?O2L@tI>E
ztRUbpeoa!J-U+Rcq>wT5&A+7p;JT}M;lzV8Z}s6Lb#ALp9HHMT$qzXRk{?dc=@NqC
z5>bjme$BE7luhlSTXsFGcdq>@5m}JQz*;yp$Xal|)#bhvPe=0nA;<2~=gT3(k#_?p
zarFDnG)!rrzgFSzWvkAgC)VnTGZNMU(YJ{o!Vd+5s+VZT-)ELJ@@dj5_2Q2ne#w<t
zTJS0AzQ<jya{cKEi9Mh5LrqS)o#&|$M(qIX@QJjBhK6;>%mtVV^&9Y5btEDp5_6T*
zU9F>5mmpkl&_cZ<S>f|2YU_552Ux(CXk;J&Yq+}_H%42ml&_L}nUFPGlN0DggKefC
zp+&jS!>V=8?VTHEa$^79+6H^iK`&a8(lf%y`%y&{PDYNBPxmxvgad#rX~!n)qg~r%
zz%2f#w|RaPxH7S_&{L;8s;!uN-x^s`Jx{ty(1ka7D`HzD*63eKLeE_I*x4L#;l<w~
zWqD*_{uTj<zWlnv@T=KM_^hKX7e8W5TMpUGi9r|owtfV^LxXqCeq~NY#=k9~nf^$A
zC8YPT_V&hbM>^YX^|GsNa(>ai`}6dBR8hG5O_PL}zv9G!4_{uUDg>L&XTi($AjSJE
z5*78((Zv)?b1(Mj<goX6Uw!(}bx~j|1I=5<X;pD-(@=Bi7SX+yc$?D1(uj@cepvQ>
zes-7rCG7EWap%J2v&82C8odDTgWvK7&=uiB7e<}fp61y{RTC#>yvq6)75)iKibcQ1
z1#t^GN+E${jpT**>1GVL3^j~SBlfF*iZjWql<r;Vl*P?9@m%04Elx@xId5dXHcsgZ
znPDi4TStE<#V-;<X329)hg4CK0ugI_KIrQ!R&huQuM58Fg$Kn4M3hby93#^_0_fPb
z9ijtjpEwkFFld!2H8RAI`N6EI?D`Z;=f%)o?(L-?MX_s!YDKC67X_+r=I=MabM*>*
zKY+$=u7BRp`T{?%nh^o}vT84Gpv#0!<-Yx7wh<MI-Gw~qEl2=Br*C$<)@0K_vgrZ}
zX%n=($n?N}s97%9%B`nt>b1xM`v+YqhwWx4YcEFHIRa+7idHw4L`u|k<b9C)IE_wr
z8oDfR$MoW``0x>R<iD30o?+g2&6s<+_E7Mnzy}F*%bRYANJiFht-P;Vy7XgO%nzMk
z#~Ao0eFEgl0KC6O()Eg^%IouCEPv2$>+yYVSv};f?(wSjWjP|$Dx7T>R}!LZg427n
zB5#>eadUflGyNLr+mI!*`L!`WVIh4&a>9b&H$<rQu4%=*{yt-)@mEaPpV2w!eXny<
z*{bLFt+D*5SQ7X}M_(QmV>dw$iWIh6DLj=O8g*4QNr4rg?5K>_PAMjhmLe&SaXMC-
z4?Y&&YVYy(9*eST+p9uTvrG4bFG&x|v_5MTe{)Q+Z2^#evv=?mZiO|{rT;WtU9qZN
z4A53EGFRCkWT?IsH#1PwG;tHQUGjF<Tv$u^Yw1AEJA(amK|vfm5eka~xwURZ-bZuQ
zf~dZKyz6O39Vu#7<zDf(8?4H1HOcH87-R)Kw^^Zk{lLXA3zWJ%sF|25=?JJI<wMX`
z3<58y=zb`%&>kS#u){tPbOX{rlQyJcbudshYL(Izj+q877j@F&fOl2@R7qqiM!`6b
zpz8rD?gHY>5K0%;2R++MV@dcIgk<o%8StpiG0}z$2&~~VII=k=zvd}Y_K&v>#GQ}N
zrk)b?tg6po@a3}ix;kpahWQW%tt309C8?FlJCtL?Xfl)%oaMVj>6bl?ogNG+<^5pe
z+WRX8z2gVSjZ9bi^zRg(4;(&m&H4wkJZ|vcz&kP+${2Gg|G7J=geYQCaWfnS-jEoE
z>HF;3xS|3tr9HXpaRst(^0(&&4a&k!x*LoJUp_Y9GtAB4JLuSPr?A~6S~!}_vA*0n
z5v4Sc8xQwDd%1HKQR&my5HI3Fzx?H$PNV}CeqlC^j3t#C-Y~s?KF9z^^IAReKUeWv
z|4)sA4QL~{@#P8+l67+m-{dRL4FZ_{@0`z?$`4D4c2JqTa0+hzan)fTXCmc-39I&Z
zl7Y5%xAQYR`G6N9Rc4&v_=KJ)S^Qydt^NK5Vn<yyGC^%SymwGqH-gscsh~c(BT2qw
zSZycpT;MdU-*wgffpJB?2^imV*N*X$24;V))9&R=50oNNa-rFjOJ6D|)6d?}!0}U!
z1^OvBh5ith1gJo^=KVgA^gBw#!x^sp*=*OJo0>9|&-6|De`f!my52G%>ZW@iS5jIj
zMY>B^6r@`^1u5xX8kSfZBoqW`0g;kM8ib`6k#6Z`k?vY@so#hD>+?MK|HXe_&c67}
zoHKLgoa?$~roW==8O8ZRC^H}Q5G(o1y(mczO$M8>V2O<#08f47)<i5G<5v@(<TR(2
z*T}&ac;!Y(Ew+X2_&!*$VfDxAjDB@-leF8wgr>0XoVlIgxi53Hwe4e}2l)VyQxlFV
z=p7Bva=_HQp`G2hKEyNpU%ai%2jcBQ5XX?TJcYK|<nedHS`qG84*q(glVfRbsrzJB
zV8NL;ej^aA%4yru@3?tG5(P$w5rhlL95CThoK*>~tnBM~C;!<OltrKNqN}Yk19lo)
zhG?p{Q_HE&ili^%JG90Q5M@5n|MeG*JHj$~>VX_6xh^@GRCvUYx1(9!)(ApDjoKOt
z;&X}NoN7p5&GEGs9MagjDK&^KeSHCFK--Ql;qE7@8^8hPE)peohec_oN7Ddu3TfJ9
zCkUs1mLxK^o$!b3X=DCR>7@OZ!+oi*)+{V0CGsR2kGsn!v36jg`d5^T-dY8_#=kl~
zlSP6J$y8b_G&~u^5H`UrO(f~d1)zd;xXCgx$+t%esmi^D2v7UMi%7ScM4NK3_3s;W
zcpmS<TNTiNNrA+XNTR~l^@&o0=aIA0K}k;3Y+qqrNtzDlqvMYp1t;Bp)EG;-wU0;c
zX-|AuO4riRkSeZC`rWl99{MJ1SfX8v&i|^<<oG&U;{WRl94A|<I@t17-}gFY>>0@X
zxYkXMbIg~h_{%-q&#jp8tz{R;!s^>mE#Vb!j$1SFmeQ<_s1~ZaaqX*`IM%GAJPD1>
zcL7>Q#|c`e7fi_&L00x%1Cy7X%N>sm&mz=CrpNc=!}dJ$-%JIpv7?MPe}XT#il!=!
z8cz~MCsLu&0q;3*=NT$?`V{}|G5(#)bY%yxO5{13c+*qr6y-TS_2fFPXukD8*jLu!
zZXdT4#`&1Q-9^QX3(Ua!87zL<wEeBr-#~gB{rF*85U{kYtgWp@76PPR{)u4$vn=wF
zxX#*Y7tUe7Nq!hDS;XCh5l>eSs3txRQnWbacER6n0#4wHeON*7HbvES{UHQAN^Nqb
z6zG7w9@-QrhW*y%6c`<ef?rcT=;d)A)CbrZ%_4#B$9jL>d)wRI2qS{q^kN$Pk0PNz
z8vRFHQB~iL0#9?eVi%07GssKkR-T4fTJn+q@Ow`E>E$DZ2Yx>_j&f_TyADizN6Wsy
zq1x=#CB-;h@WRQBXQlPr)77+9_BmPXDZENHL9<oz5$$$<qd2rzCMMni&Qv3l?bob!
z#U#7Fyf-tk_MpqdbUi%T(4WKPAcRr1V}fhOwVJCSMN=4FZ-398m`E$A0jiq1rGV`q
zamlA^)CwRZ|I}G%ye7sw#FWNV*9o)CP75gNXug5qy7u&gVO;r!%0Acu)3IW!j{H~H
za=@}8Uo@`k#t!^?tq#TF4q$)F?}5TWx$dE&%&*>#S?<F7e!j9txaTq@xtBku8_*sB
zhqPU84HO*)4RmF^M{y0!(Mpu)f(l}ca*ZYhANJpGeWK=Pp9Rgdzg7}geZAT`PB{CT
z-vN}9<u*A&Vexp|l%O6om{X}dv299-HB7EhepL}2aADtQj~^d5tk-|k;m$K5L$^zX
zOk#ANUIB@P@Q}WARLD~o-BQ3K&4k9ohcGp#bB9FxhCSfoy>YN?uhjhvVpcNDL0P-a
zcVNQ{f=G3tg*fu5fD<c}@idr(YLb)xdeuf9GC5dwt&?}{?~zDIxl?Cc=|oLNU0q%r
zP{DR>T68{6p>WRw>Ha?>ZpW12CsTh43>=<i-WzmI<A#XA4TchIk_ANwwm46xa@==G
z*J<)}16&(Der31MS||5i{<R=Em%ivgheGfX-U3vL^xd_bPx&YP68niEN>b(82FrUT
z_D@J?b417=5SsPMtq2B~#GV7lv<&MnCkdWB6x#RgREd#Xlk_r4;8dFM)DQReaBueo
zUuBzlnC8rTg7cee1(qYDW+}vQk27d&Gj2$(8k4w0SHkfbG)n5l-|C{%4llRa^Gx>3
zk9)PkA_FjfdDL9b=btWS>uMbJ%jD_Nc)36*fKINjM{fg3M;^6^pGS>wzqgT@K|zku
zg<}%Pct^qH$i~^9diYcjmgy!(XR_IyoF<^G{C&g4M5f6Ixi0Kv=I7naZxlp-b&V5t
zl@eyox2DB#U~2FDnkVD@5O@6xDu@mj+K`Dm@B8@!xBG`(xYL$?MyS$w<IbXPI{nXE
zHmE*9&}@tGx?SoYsUq4YXK4Wdx-;$`7)W2Fmm`h_aA-!aSxmGby1hFKt>1AlZKJw%
z?HIs&2Exi8=`bwrL3f@_qCI#w74%RaW-C%UvqT~v$PouT8SddeVt`j87|iojJkU{+
zir%^Yq-F1J%0*!INC5>{=N2xLo-D_WD{kgeS$d%j!r$gnc73?a_Dx}M{nz_s9Uaxk
zkhAaSQx<6J)R3U+Hc(nq`0J&?c5x{Uzh0cd?L20!F{b%M1WR`R^pwz&ETXv?niEko
zIB*H1kE#ex;e*Vr3}i`al_H7%#Z7$yCnDOw89Hw7cDczaG=e@y4SE6~NgX!*-(^e%
z$(ev{Z1b6eXCsf%lC=-j6>3Hk{4EU0>b<XF*Nc%d;FBXu_x{ygAp9)(wXH*eL9+%)
zu>b}1d*LDgls^1XOhLV0Z<UzDR2%L4#X-G(;Z@CiZFhQ|UxIj($HY^_0zsNc=punt
zgn<%tcob2V59~p?eXZ)DSDoT{)K;r^T=rn3zvA7p+<*2~U83xn`@bgCQ=D7^wa3hL
zotTkyVQh~2&!)nDqA19M+%<LAJ@h<Yyvj^$zl0<6{sj3l&(pfhjjoPMe1T;`B9IMe
zgTf;hbg?=jkNcR<bg*&`mQH!qJ#w)l2&ab<2P6M8b6i@$Yjy1(2GC93Dj9etA?fq%
z3xti9fSF_PGMW6tW7y@DVlmaG`1yc;^hkT6Y#B_bH^95H`0uQF{cBmCTaGxcC|w;1
z!^1$6ngh7IkApqP$xyP6z3Kgl-*KR!$t2o?MW94|nR!(r(}i_i8P;8IG2+^A9+C$f
zK}Qq#`4l7M;V-{(&Kbq7=K6OpOund=$_?fSkl!d8D0_bQBRd8|*rNbS*Xa6ihz|-`
z4MuInBx~+Px}kdn3rgUi^^q(5m~epPKA%H=r-*K||AQ;IJBv2?go!by^2=)Ers)a;
zy<t$U(N2K=Quj7y8W`h{*g^f#6M~>>uHui#hF|=8-$i>Lj5Qv!%A?}NiLmz^?fo&d
z9X$1kpmQFL(K29k`oUfJE^5!9>pGpbX}xIDdeg$6YLk=S$vqE8?k}S7=!=*jf|=i8
z>53tmx{+h!n=TN+0#UciU09wUw-4ttMR7{mUH3GCi_;t_1Qx@FU4gy1^na$bxc`{(
zqr&*$pQhblrXY~J;Gkab_9)zV$ll8aBIW)L;%HRvD^QWx<^A>}VYSfj8;lG_fC}88
z60?Srvl>!OquDkROJuS`;slx{_o*9@ktUm^vfJpx+jP<Sq@;HD-}_yP^1cZ}%4s$3
zPTY<$5C{&@b`XB4@xcSY>flp9AFLXSbvpV`!O(|Wd`*kZ%<fs)T(L<vHS=+u7319(
z?u$PVSSWPepFM9hEtcK>?!n{a3f+BYOXnJuu9%79voWwr-Uz<in&fSLK8$$oFr194
zAr>q$>)G=9Uw3=N!rMe!EqE13!gCH}601&@nm#=2WuQ#!iAy6>Jqy)y)4irMyvKRt
zl9B!cxhr6_8T{YmGaqsJUfE$Pt-fqT$?;&&6+E>UDSih1xa|8mV7B*HD<{6WSz~$X
z7P;kn=Ee;Z(Cvy{>Oja|=FWf8nfQ*5GONBM+9Oy2=}f_y;AH5G6Io{p9}5=-c1yB?
zWXpL_?#G2S%lBW2at5CG%F-RnuJ=)n4SEi0!}q}p-%QQhGZM0FMz*`d<ND2*zsA8F
zuW3A&okf0`T%x>}y-_mv0oqVFOzf8I`T!iK47dd6ox+T!X8w=>TJ6Od<sZ-7J{s}l
zQ|j03a;G{B?D9swuALmH3lQSAYT1w}oP9@I`bHd4l52s`lf-6w^uqw*d`w>rla%&<
zD3!0~f{GaMLBw;#-V=%XW0ZMYl(U>A)_9hlwe7dtK~eTxLGCZUxk0SZm!ts+<JYb#
ze9Jg90ZZIgp%4F@jl!<qVxRGJ=GY97*wt?ehZ_1OE*n>45F4HgJ|rtE)M)N~aXOt2
zopa&Rc7WhgJK~rxIf@`A+cgY#B3@%F>&Rw}4pjJc;Btt=f4nLoqmEk^H+^ir^#xic
zjt$VtSx=&b5+6AD&a!e>nmy@f-b?$aW<R)*xA$;yj+uLkCXcaG_>9fJW`e8xoQ4^+
zX8dySZy5*Tb6&VYzl$YGbfwFV>g*c|u8Ab(bS=*4*iBd?EMA2+<DF=u6EGhQn%RRt
zKEtJ3_hxBkkW>K@+J6Kmi;RbCY0mNwlcPguvOf&;eB;|RFhEvu1huWXd~4o1d)IC6
zsbH?(>UB$!u6}wRdNZX{R4U$h=7F0#`S?b$h1{tC5vfFNSW_bth8@Q9RM3~e=&Dt{
zdUAB{>UKjSLAV9}?oJlrHc770Q-;f-!;lByE4ve6A!d-9IK{w~?hBM~`4G#X;!}Rl
zQgL3}o)6~0J#z}^LDdCz1|jP$lVt(uG#QKk%3TfV-bYs9WNuyMp<^EyXdTX$SG#r7
z%^bE+9^Ws?Q<qR|bopHjk>vmti~v-+GVp@fNGn-@8^{5oU_ZT1@_pwTq6I&Y*9~`)
z8RMnzqQ2@v%rkUKPh;;lBH5Be<GT{J#FK|om93T+vW!gB3nEJQ{5kVL_>e@hi2sED
z3jgFRz*AoPDg`eI^?H6mX@yZ>T^ZGTNpvFfeUbCNo8&jEb2(#6j^J=;$nvz1lCi_6
zcliHeRt^ymvwG#Cp1xe(Ri~&U&ygYzyXkO}qBBCnW4aX0@~Ro7k$*OIajo^9OV9x?
z-5x%6hBFSZvr%U_I$e?7^d)I-nmB6AmQ6MzvuKKwBn&bQIjTAoaAduTM7A%McJ<HB
zXMgTwiyoo%pR#_~mV-IYw%^qT!VNREF?0n|U#*qoVdr1Tfny9*2ErN{XQ$_0ea!b6
z3Y0$!xS;fJwB}URK?4Jz<r@-h+7e;tO#ar>Q~E=c!)Y2kxa`)QB3;<}5kUsBaT~6h
z+j_so<wu*h%ForJ7QcUG$69ps-z2BQmM?ZWf?jDxp596r$&F#eFTofMG-aiNcvaa7
z18IR9XURbIXKERY_Z-QNx<hzVdKUtdS&49{at++OZ+x65qx(Q38aEN@8`<**5h5Ng
zla=6kQia_Yw0Qso>4HP(azTDJEf3;eGi#jZhNLR@QFB9l;pYkBL?4&oZwK8z(|lPa
zw{+=S-d&n=UeUahN;Nu51KPlU(zoV}yHX8c*HMS31^9+&AGvf090WL2SwySZf>INl
z4=Kl@dZEC(fBYv6c(>cmM_%=<DaW169Aje5rk*g5uR^!jX9IAi;=ykxPY>Yq<>?C&
zA4XNu>zq%;QuvzE`J47GF8=_}sQn1MJZ@TO03~_!8kXB#&E%hL?P}=2+56tA83%E9
zA>?na1ZVWGVO&y!;6>O%jeYE7uQ<;XIdfcuD)3k~p4ZcFrR9jk%`Y9rMn9Q(K?ryT
zo2kDFuG4%~$e<VaIrXt&-b+^UP=(fdh1*Hzq;2D8w%H3=nN9mWy?^m4dyZJX+xmh9
zHyNuvS!QfP==eI-+db=HQiVlWzns=-PneVPqgNfY+lA-3%Z3+@46a5U4K<>ii9_kT
zO55Lvg_&cHnK-_SQcaT-Mcu(7ofc=33%j~TW!v*Y4m`VlW^9R~$L|`i#I_41HT%7H
zD3dpAMD}#WtDc5MK^ods^|jj*>I|0#zg9%B4u82`hkmW7V*7bQ6GZc&((QB8Kiq;p
zvCmy~hsi8F<4PZ2=m01klk!zlX?ibXi4Ptsxbqpbi_8_`a|N|y;DCdgyR9Rq(PEB6
zI~o*;F!m}jODDyATL(AQ_um#|mc55G9ye*wY~t4_XLotfIzHx(vCrD8DV}Vj8AU@j
zKEi+S?B|)@^ycn!u*DKvU*CwusItrSgK*s9T?aU+E5y>&z%jP$$R`Rjz7Lnwl29ZA
zv&3MH#`97cqi!Y><7y@Sg3sl2e{5_yEyw2Q7B!IDBJnZ=YLS$qhb)Y{;Hx+Nv9&I$
zi%3ZPTQMeyUI-@M*3p^o9lK!9PBeXo7H|SZGt_{$kc}hTXtco2UL{UG7E7k#N8bYE
zqN9xOLq|czhC-wL=~)@ySEYB3EeBK_mj~!Y=k^w>xX?-NnU`Sx-MV!`|NJ=4Ol;*$
zAL+B6wbRH!&phN3%sT4(afg`}+%gXO14*Fp9u(UVyKZZs#;cpLyPmEni+vplHFSFq
zTyZF0%V}sU`CpP}GkDS{dpWOT5WO^rmS50l$u$J1%Xx<>V3#>)wU-ukHUoniM@w<w
z7}pcUjekH7LeYbt{)q={>*h>BLh%5?YYLJp#q^~Af%Q{Z>h$(}77Yi_XvMLZ>)}*n
zjzH@r(guq>+wXbtww6_^RWGF3I4||HHaKxf8XMhZ4A6nRznuA+dzm8e!13^;rOJem
zGn!a38d@Y;cD&K(<h%Ov4eJQDeE~tauL|8J%Kv)9BaO?>Z_@X~Heq4gFcC3G!WJ1R
z*I2?2U&P6u4|yHU-UqcnqTx9mWYw1;bx+xO)SDK)bizcx&5P^`*_J@kU>jBIpDhRt
z7%DZ}*Eb=^+JRw-F1_>Fc!dYmTpzsvD%7@fi)-w3+;5k-3sVlbHNO=?w_C);?0#G0
z-0)v|a9NExG~y|Zl57~w6TWyu(T`BlJlYa2kt^dlub&cr7E7L7CG7vHrpzYEV@Ba2
zobx+3`Fe|gh&|T@)ROD=5Djh6w!}fT(Ty6D!op|OtIwZge5q|^{vdefZ3ios__g>C
zrVi*7zlS|k)GIn&09MDb%LAsG-!PW2Az^baaWmBib6`Bgvgl1$^N7{=5#dEr1#e8K
zxNp!<XvFu?8q>1|@V=DvZOMx5o#tt1c55nd$z+2ueO}F1DjH$tSW&KRb#h<_E(8p`
zI_n5~eB?Odn`U2zP8j*^5ml0;bYr@O(>O^M+XMc=K_N09i5R1nM;+1P7+GB3sHL8k
z2-%_Wn|^BALxRncmrwBRDS@pasH?c6y@5bhcna-w#|0pp`+dv^=TADytD)m8x-AJQ
z|16XL)6o1M6Q62w0o;RDP4y$KlY4fFfoS%+eU2dda-WT%A|xFPyVsS@K>#$n7S5dd
z3%CCswCNCC*Ce#{j%1Vp)QBca3{1n*P2R{^FNyf4Ds<G7`2poWmneO;W+=`$Tj+3A
zXv)PD#J2|up>WI#zFExvT(>J{3Aa_ZxgX>cI_YK~BTex<f9^=V@O4!&@D_^0@(ItA
zT#~~6BHLY!;4zJRz6%)L^R1_W6$M^DpJ*S)87(FS7@U%*!w2%J8DNh+s(u+gO31R5
zCQz{<wC>*c4$sW^{s?w2c@XL2=qEg~*y@5e1GGjAj49q1z&ox&>fcw4v3<C#O(I?H
zDEEI<hgsnlZR=Vu@N(~jtj$<Ai^Oy<SJNcseLFj!xn<;N8SNpD4TWn|CH^~ffM1p8
zmW+Q#rZgqidl_H77^&zebcjc3u=vDY(e!AF8|sH_#8#bo9r@c7Z?D&NE_J>1G?Y1Z
z=KYkjMe?!>NwIkxk(Mr<&@*i*3}QrEo6%bEurl3Y)v>>$P(SD5g%q52K&}D;<8qDQ
zma_SIhDlL7SkxIGg2#mTf<nFNpaRB+{VSr{RT)R@rG4T8Yx{e-7f0W~EqRYFwr!SA
z)7_z$H)Z0iye0!1N~;dfFM;z9TdyUC{w)N&yP|(RMl6%31yHZdSekG5b=Ju!s7^iW
z7E&^jz#kIUB8zES;rc7?fpj81Po4L@3S|-nl$NYuOUso5LT2hZ$&tw~+F8x|lBvf*
z+W|o<?y_zT!P9tdZd_vwd{e=*9EeJRh_~KFqzbT&%1ev`*PZK^yQ1V5S%$M-E%zFU
zqPHi!LOEj{9*a0VI+E5#>yd0Ew1ebuIRu#fA<x5V?WCx{d`#3}W{NHA@?ekS9~&52
zFbrtGJybC?(*yzO{qgjXs{2G^q>(uzh4*N?6`$J)Im$-G?rqG^JN;PvTB8to_1)Ek
z7NfN8c?5F*QSQj~Q})yPikk(PWgJ%bbaoE;?GrPMGaDWVR><S{rg_aMO#3Oo|H|YJ
z<<!*FM(U?2IO3|6D<AK_(QH+w+uRP4eL2gzqHce>g+W3rD*Uyc#_rKmhgL_>fq&|0
z9APV6aJnr?b=tcFw>`*+Rej%K(HS83t0~4`c>S=#M^JWE@)I5&@k1AXyaJ*u3}S<;
z+d$uSG%9V6&O?nyo3Eb8I}C_4PODZG>tKaOgk<Ua)d;`2k6klnUJM<BR&0>A+uau-
zduS3K^Dcx`OY$%(Cx=d)E>7S%8%FFmQ?&3<Nw1f&<!6CyosEcjRVaOGv+vn$<^@5|
z+RnTi(tpnFMrb{t_UYO9H-ZO==tTC22&os#p~TB_ffd&e%Tt)^EO->mDr+6<@denj
zs{SM)oi<5yytC(r-osBsea9*kLIcj?@Z-IylnD)DoHyOh_t|@IF$=m;mnttSBDCPP
z$)e5Ka%z-_!|}D5NHw{ZMpcevfg)%R%JHPkKnyKr-H6%uD*YErHBwA$b*tnL3^x2b
z!FEa9y+0?YN$N%qiF5H@bky-pRK~g}Q~IoJu~DuxQB2vimHlH78yh5GQ33`}fDK!?
z$a5z4`pf^~@d_MU|Ew9o&(6o%)0tZvqt9-un87BO?THKxtl^fTw(}LmV)tt_AT{Sv
z=<N@ZZ9aLW%++P<B+)Q)`j+d8=Md(kTK&6fDNlEmfjCDh_-k#4tYGK!5>Crfid@>F
zMp>4%7l=onv<&<)tTQa%OQZ?*)740`ndDF~@di9!<7t0^__+H0Bc3JV598X85YzbT
z3k6KmXw*On4=bpyRw*-w@=3DDYZ$8GgQ`uk7oL^gY3cvppyTiY1lp{XmhvY1QWIa=
z=^XB;!eEE*#tY)J+#LK_Dzmy4E!m#nb5C?KlJTJCzoev08)d31v453{$WL0)ko#qv
ze+ieJzyTNT9zJ0z^yZw|*h<RG(W<c(j&3Fo0R}gq<Ioipty%@vBgnj{d44!Ce!xI8
zYbU%c7zV>94qcuO*dNFgVwusA_b*ZC66~})9+=^ef7V4fd-Ftd<E$Wt_IoCMP4eCM
zEDH6`bULWgSp09kcQ^Dt_4dE!W)FbAPorvmCz#@t(7PhwHqpDaOHfv92wp8q%hG%s
zOU9oyzagT$H$Y)-Pe~w_!m{_OOY~_s<x0%U%vh6d-g$m)oVnwOfwcBln~yzaD0@&1
z2kUIqMAMU_ROt_V@YOy<09uZc0eKGKvaq!cH${81D&IfT7DtS#KC{Y#;=jwgieH<Y
zY?rc63^^4W8A!zFX1NIsTYQLqq<*#Zd`gd9I+bJ>%rGWmj}KGhH+f=FsQ(3jGt!eI
zn9DZRZfi9triDK<Dpxi9&8BETC4Rt(a*A=K5iD?WvA5KN{)6Q_Jzn!V;K;KJ^*Hbm
zcS7U~x#<~sY4!Y%m%pFKU>sq3hg?;zksRT9=g$_r5SkpSq4=zKzFF;|+1R3S$w*OY
z8CL2j`c0xChDrSRN!l|C>t$X?$+YO9b<W@GQX00*_Hog_-NH0ACQ3gzQZ!pCnl!yh
zeBQR+^NY*F^(=TG9=Y-&l>)*bmR}lgTWn|5ml1N*jlMrM*rU3bk4m{<cAe5J%<5T0
z-}iPknn;J8#{FGgj6r^YgfLLLKD0?XpySOkqjopHiei&285X=z+n3Q+bjH#*T2s_i
zR{1QdJ%%PEA@A3(UlKOxOP0Z{i-!J$q=`vYPFeQb(~4?imC|Hu<h^)Q4oAlwB8jcn
zB7OF!DdUUPK)*m`^Xw+$)b6|f@?R_0{1xVZ-E76|)Al#(1W>%Hcm6+*8-|EV!DV_G
zSCXCf$(23~^5Zeuj1or)@b8b`D3CiiR@6jdl79LrrqQ6ja{k-Gh1jFWOgPDwaY^P=
z01XER$I%AKx58>Iq?k=k7vFOKc=E(p8}L~1T%dnUQbI0h;rrmucV)|=EIIE&hhncx
zeJ5V#9;_h;;lLS=l(+S5Y1Q9aP*iih1aE8m7@T=_K(|p?`#wJHO%XC9lq)!Z4=s#7
z${5qPxcdqO6+zfaO9?(<70bw{e*G*)Oo3|UH<*QWQ@8Y&6ct=bN7IU7vA*$gDKQiO
zT1^jm8YF2NyeA^7p(ULMT5wvt0E;IMdG00SSk0~+C3CD+A1XV@F;k@7xTN5JtyRm=
zH)c$Q(kgJeVW6x&eP;L8?RE-WuV}fML<N{9fo~G=YUSfj(Jz7kgXtl$FYcVTc~%!^
zg72--@X5r9mzUn@=D=V#%5ptOZd1IucY^<^5sd+(Sb3)7rGx9z#&f~x7x>*RHS`eT
z4?)F)Lqq%7m#P}1iLW;!YYl$FYI@TNjy6Udt#Ni~)t@CKBpj#Z{&tI2vexe2sSz3Q
zjUKTwNMBpqG3Y<)pU`IVGt!7<WONMx`Sb48G>1K0!8}6u&UU-&*T_DESNHTQo4>QK
zQNZ!<7pe6Zb@@`4j49eRT@&2I1?pw7zp_BenZXd)5Yui5O$hb3H~1t~YLq0brpMc+
zW@cuz^JWp*g`vtOP4gJIw0_P0<<CmW5==Lh+L)NZ%<RW$Ib=1Lxu=a-6e4~ZrRAHy
zI#L){<C+jkr4oK*i?9DE9#sm^)mq=O=U>Jtpx*gO8q-O{vYHjg$kEVe#_FQ{H>G3j
zGam1^h{y3}7=Ye`9LE;A$I20N=De@y)%=^JBf0`OuCazbD@V{&Q)gC#eDI;cM+6ks
zxyF>AElD0=+>~7^X^@W7k34p+4H}t71pF|F=6l(56@}=d-gk`uL37z}ZB86?wz=wx
zkT+OKDBm7XRMNJJDpvOH>Rl`mS>;j(2`v(3?(m<h^A{(Wz35M5LW{-j#s<vT_7&8f
zDIoUv%SA3CIr{h{DnUv&@oVuYZSz^4gPsAS?>15I>9u_B<?%`UbBhr7^a{hP1YPCM
z`F-Vb5k$N=^PAjS&yrm|CdkI~DfXiaze(GWc$J9ANRwgzT(*cUo;!cD`+H?+`5S;%
zXHR>_#%HY#inp1-M=yjNr7z1k%s3H3Z*+SrYKvFi_foH+n;zD0Hso;=>peO*7*wsw
zrZb7wXKA8O2u(zDC|D9x+$30v5tS6TaSLsFtFai@^3=PXOg>%-_`D)62HNcyFv~GQ
zS_x88QszBw*&?!qRZvU2))hX;wH>l5x7*u(;@R5f9~!73l;L11OtXp=lvtL~+t1-P
zb6kx@bL!K{xEg=C0)$W=x#VUo_BO<=(!$I^GnI`fgY(c^_GEI%Y(zejTkfYGY9>lQ
z3B1Mv3{y(7y_c;77lrzrI4(XxUW|L;5=WBG#joI66hK^-qS-tnS+YESvcpHgVw=tX
zjJjW!CWcl0EHay|=oPSBH}8EKnRU}u8W8ZPf}Gv=F11UxwL=Z+F@nW`7$Q{~ci65;
zabTYJ300v_uC*WMyhW5Ut6yO*V=*R-{$fArqxWRDH6n#SA#`7(6rVZ$aE?;t3#j*r
zl?WDuC>*r(>8?kCxlNLAI_Fpk)RRy_YB4MkjSq_T2p%QJq+3F)kaOTtKWPZ$Fe;#>
zCG5~SD+?Jl$^8;eV@3sr4?C3yI5T~Mu8L=Z49>!UPPg54x>Kypm}h`kg}{BqCSga!
zZ|qqikMlftibmxtCEaltPqAxQy>MtIt?*IX54nQ?s&x>0X3q175KdnCF9}8^Oq;vV
zdqa(_uOuNvy}aJZJ<UR|EP))w)nmeCGxLI|KDJny9cSsoIem0E>r%uy!(e#riI6;f
zEUli9G%%3k=QxU(fK9b1Sk}$k=1Rs`u%2{+!&*r?hd^WdkxVgNNMv?)_8+;+BZVQO
z7sllsr{dS*z)H^r_O{U!N^F%l#j_Sh-b|xs`=G*jq9m=pEiMnulj|Vzi6;oqb+(SN
zf2p)}A~!$h>K}iU9uu^J_}#8%9joGFr;0MF9b_g0r9U{uDt+D8r+4lO{(|$?{K7dP
zFhxoes~r#W>gu6<I|)SA?<7Lw!3yS{kaUL2YIyDoU~xC#;^O*HSZ~~Kn-cv*methM
zl+oG8x(Ti9-9CXLFRw#BEl2U!b*&>$1dR7`XEjJ=nYB?%stPZDHZ!r!z1xDa%~LsM
ztBl~e73akf73zcq<2S8`=L-Aa=L7Sdip~F!h3W0$n%`%KPB+JjqKa8WiX6MD)ZC-M
zmHS8cy<5$x+X*(Ff5~QxaQ$}Nks50m5*DzK<{zoj(<n{u9kM3I9;VIAyQBsj-=~Dg
zU&Uc>UOm)X0@4N*pesVJfv$wV*+_n_>D1j|)VW6Z8QA@+e*2bbkz4lgo9Iq2?^`AX
zMr%z43DUL`9KND@q~1<;D4X`kxt;oOQb<anD5uLbBAcx@2#9CWX%9Fu2znY`?e$V{
zEW4J!%#3^URYEd<-Nc*|O)`z>-|iPa4Xwiw!+Jw1t3mh~?nNT~fS&33zsB(pX!s}<
z(+d3m86B9Qp+JKo{=bX@G$@$=w&0P~AYGN*j1-^;8i;`%fgR`#wvtH`4$u()1Q=#b
a<_%HQX3s*X0StK$_$kV&$&^W(2LC@!_r6B}

literal 0
HcmV?d00001

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
new file mode 100644
index 00000000..e27a0f92
--- /dev/null
+++ b/blog/posts/ios-vs-android.md
@@ -0,0 +1,74 @@
+---
+date:
+    created: 2025-05-19T20:15:00Z
+categories:
+    - Opinion
+authors:
+    - fria
+tags:
+    - Security
+    - iOS
+    - Android
+preview:
+---
+
+# iOS vs Android Security: What Each Can Learn from the Other
+
+Both Android and iOS run on the vast majority of our mobile devices, meaning they are entrusted with our most sensitive data. While they trade blows, there are areas where the two differ in security features and philosophy.
+
+## Source Model
+
+One of the most glaring differences is the source model of each operating system: iOS is *mostly* closed source while Android is *mostly* open source, I'll get to what I mean by that in a bit.
+
+### iOS
+
+iOS is a closed-source operating system, but it's based on the open-source [XNU kernel](https://github.com/apple-oss-distributions/xnu). The kernel handles almost everything on the operating system, so it's good that such a vital component is openly available to examine and do what you want with.
+
+It's important to note that being open-source doesn't [inherently make software secure](https://seirdy.one/posts/2022/02/02/floss-security/), but it can be helpful for anyone wanting to audit the code.
+
+I'd like to see Apple realease its entire operating system as open source in order to foster a spirit of openness and allow for [reproducible builds](https://reproducible-builds.org), allowing third parties to verify that the downloaded binaries match the released source code. As of now, that's impossible thanks to iOS's closed nature. A fully open-source iOS would also be the first step in third-party 
+
+### Android
+
+The beating heart of Android is the [Android Open Source Project](https://source.android.com) (AOSP). AOSP is essentially a complete open-source mobile operating system on its own. Android was designed from the beginning to be used by lots of different companies for their own mobile phone offerings, so the open nature is useful toward that goal.
+
+However, AOSP is only a barebones operating system. OEMs are expected to add their own proprietary components to make their own, custom user experience. This is why most Android phones you buy are full of proprietary software like Facebook and other OEM software; companies that sell Android phones mainly use AOSP as a secure base to then run on their phones with proprietary drivers and their own custom Android. While the openness of AOSP is great, the OEMs making the phones ultimately ruin it.
+
+Because AOSP is open source though, non-OEM third parties such as [GrapheneOS](https://grapheneos.org) have made their own fully open-source Android operating systems. GrapheneOS supports [reproducible builds](https://grapheneos.org/build#reproducible-builds).
+
+Many custom AOSP operating systems, while being open source, actually reduce security from AOSP through delayed updates and not supporting important Android security features like [Verified Boot](https://source.android.com/docs/security/features/verifiedboot) (this problem applies to many open source Android operating systems, but not GrapheneOS as they explicitly aim to never downgrade security from AOSP).
+
+A problem inherent to being downstream of AOSP, third-party operating systems also must wait for Google to [ship patches and updates](https://x.com/grapheneos/status/1964561043906048183) for them to apply. Ultimately they are up to the whims of the upstream project which is not ideal.
+
+## Hardware
+
+Hardware is vital to security. Modern smartphones are complicated, with lots of different processors and components, all runnng their own firmware and with their own potential security vulnerabilities. It's important to lock down these components as much as possible.
+
+### iOS
+
+Apple makes their own SoC on their platforms, which affords them a lot of control over how it works. You can read about how they integrate their hardware tightly on their [Apple Platform Security](https://support.apple.com/guide/security/hardware-security-overview-secf020d1074/web) page.
+
+Apple has started to replace other components as well, with their newest phones boasting their N1 wireless chip that handles WiFi, Bluetooth, and Thread connectivity as well as their in-house cellular modem. Apple has a lot of control over the components in their phones which avoids supply-chain issues that other OEMs run into, with each third-party component relying on a third party to [patch security vulnerabilities](https://www.binarly.io/blog/the-firmware-supply-chain-security-is-broken-can-we-fix-it) and fix bugs in their firmware.
+
+![Graphic showing the supply chain of various OEMs, and Apple bypassing the whole supply chain because they use their own firmware and hardware](../assets/images/ios-vs-android/binarly-graphic.png)
+
+<small aria-hidden="true">Photo: [Binarly](https://www.binarly.io/blog/the-firmware-supply-chain-security-is-broken-can-we-fix-it)</small>
+
+Apple can deal with vulnerabilities themselves when they're reported instead of waiting for a third party to fix it. According to their [docs](https://support.apple.com/guide/security/peripheral-processor-security-seca500d4f2b/1/web/1):
+
+>Whenever possible, Apple works to reduce the number of peripheral processors necessary and to avoid designs that require firmware. But when separate processors with their own firmware are required, efforts are taken to help ensure an attacker can’t persist on that processor.
+
+They take care to reduce attack surface by disabling debug interfaces and signing the firmware with keys stored in Apple's own hardware security modules.
+
+Apple also supports all the important hardware security features you'd want, like a [Secure Element](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) for secure cryptography and secret storage, secure [biometric hardware](https://support.apple.com/guide/security/biometric-security-sec067eb0c9e/1/web/1) including 3D face scans for Face ID, hardware-backed [indicator lights](https://theapplewiki.com/wiki/Secure_Indicator_Light) for camera and microphone, [hardware killswitches](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/1/web/1) for the microphone on iPads, and [MTE](https://security.apple.com/blog/memory-integrity-enforcement/) for their latest iPhones.
+
+Processors that deal with networking are isolated via an [IOMMU](https://support.apple.com/guide/security/security-features-connecting-wireless-sec8a67fa93d/1/web/1#sec7e0184776) so that they can't access each others' memory.
+
+Overall, Apple does an excellent job with hardware security, most Android OEMs could stand to learn from them.
+
+### Android
+
+Because Android is used by so many different OEMs, you often don't know what you're getting in terms of hardware security. Android devices, particularly cheaper phones, often lack security features such as a [secure element](https://developer.android.com/privacy-and-security/keystore) or [MTE support](https://developer.android.com/ndk/guides/arm-mte#hwsupport).
+
+There aren't really many examples in the Android world of an OEM with the same level of control over their hardware as Apple. Most Android OEMs are going to use third party SoC's and other components, which introduces possible supply chain issues with trusting third-party firmware and potential delays with security updates.
+

From 6d2c97711684c85f651d762d5b89c7ec10a99de8 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 06:15:11 -0500
Subject: [PATCH 02/68] add app store

---
 blog/posts/ios-vs-android.md | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index e27a0f92..9b28a0fd 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -14,7 +14,7 @@ preview:
 
 # iOS vs Android Security: What Each Can Learn from the Other
 
-Both Android and iOS run on the vast majority of our mobile devices, meaning they are entrusted with our most sensitive data. While they trade blows, there are areas where the two differ in security features and philosophy.
+Both Android and iOS run on the vast majority of our mobile devices, meaning they are entrusted with our most sensitive data. While they trade blows, there are areas where the two differ in security features and philosophy.<!-- more -->
 
 ## Source Model
 
@@ -72,3 +72,33 @@ Because Android is used by so many different OEMs, you often don't know what you
 
 There aren't really many examples in the Android world of an OEM with the same level of control over their hardware as Apple. Most Android OEMs are going to use third party SoC's and other components, which introduces possible supply chain issues with trusting third-party firmware and potential delays with security updates.
 
+## App Store
+
+Android and iOS have very different approaches in terms of downloading and acquiring apps.
+
+### iOS
+
+iOS restricts app downloads to their own App Store. Apple claims this is for security purposes, but it restricts user freedom and makes it possible for Apple to [censor](https://9to5mac.com/2024/09/28/apple-cooperating-with-russia-to-remove-vpn-apps-from-app-store/) apps in certain regions.
+
+The App Store does enforce certain [security](https://support.apple.com/guide/security/about-app-store-security-secb8f887a15/1/web/1) properties, mainly through the App Review process. This process can't catch everything though, and [malware](https://securelist.com/sparkcat-stealer-in-app-store-and-google-play/115385/) still slips through the cracks.
+
+The lack of third-party app store support means that it's not possible to use an app store with better security properties than the Apple App Store. For example, apps in the App Store have Apple's DRM, which makes reproducible builds [impossible](https://github.com/signalapp/Signal-iOS/issues/641#:~:text=So%20while%20truly%20reproducible%20builds%20are%20not%20possible). If one wanted to use an app store without this security regression, they'd be out of luck.
+
+One positive of the App Store though is they enforce things like a [minimum SDK](https://developer.apple.com/app-store/submitting/) requirement. Apps built targetting earlier SDK's can be missing newer security improvements and potentially have access to more data.
+
+In the EU, Apple was forced to allow [third-party app stores](https://developer.apple.com/support/dma-and-apps-in-the-eu/) and sideloading in iOS. In order to accomodate the extra security risk, they implemented the same [notarization](https://developer.apple.com/documentation/Security/notarizing-macos-software-before-distribution) feature from macOS. It would be nice to see them roll this out globally, but it seems to be locked to the EU for now.
+
+### Android
+
+Android takes the opposite approach and lets you simply download and run apps from the internet. This gives you much more freedom as a user but could potentially open you up to more malicious apps, for example apps that abuse [accessibility permissions](https://blog.pradeo.com/accessibility-services-mobile-analysis-malware) to gain deep access to your device.
+
+The Google Play Store sets a strict [SDK level requirement](https://developer.android.com/google/play/requirements/target-sdk), but apps downaloaded outside the Google Play Store have much more leniency. Sideloaded apps can target very old SDK levels, which means they won't have the same security restrictions as apps targetting newer SDK's. The biggest restriction that seems to exist in the OS preventing running older SDK's is if an app targets an SDK at or below Android 5.1 (!?) you'll get a warning message. For reference, Android 5 came out in 2014.
+
+I think Android could stand to enforce a higher SDK level and simply refuse to run apps that target lower than say a few versions ago. There's no reason to support apps that think they're on Android 5.
+
+GrapheneOS raises the minimum SDK from AOSP.
+
+Because of Android's support for third-party app stores, it's possible to use an app store with superior security to the Google Play Store. [Accrescent](https://accrescent.app) is just such an example.
+
+Accrescent allows for developers to control their own signing keys, and doesn't require an account, among other improvements. This is an improvement over the Google Play Store where Google controls the signing keys and you need a Google account to use it.
+

From f80d56129fafd9fbc14d093c05a4fc68a6381005 Mon Sep 17 00:00:00 2001
From: redoomed1 <redoomed1@privacyguides.org>
Date: Fri, 26 Sep 2025 07:08:41 -0700
Subject: [PATCH 03/68] style: Shorten links

Signed-off-by: redoomed1 <redoomed1@privacyguides.org>
---
 blog/posts/ios-vs-android.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 9b28a0fd..985e626d 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -24,7 +24,7 @@ One of the most glaring differences is the source model of each operating system
 
 iOS is a closed-source operating system, but it's based on the open-source [XNU kernel](https://github.com/apple-oss-distributions/xnu). The kernel handles almost everything on the operating system, so it's good that such a vital component is openly available to examine and do what you want with.
 
-It's important to note that being open-source doesn't [inherently make software secure](https://seirdy.one/posts/2022/02/02/floss-security/), but it can be helpful for anyone wanting to audit the code.
+It's important to note that being open-source doesn't [inherently make software secure](https://seirdy.one/posts/2022/02/02/floss-security), but it can be helpful for anyone wanting to audit the code.
 
 I'd like to see Apple realease its entire operating system as open source in order to foster a spirit of openness and allow for [reproducible builds](https://reproducible-builds.org), allowing third parties to verify that the downloaded binaries match the released source code. As of now, that's impossible thanks to iOS's closed nature. A fully open-source iOS would also be the first step in third-party 
 
@@ -48,11 +48,11 @@ Hardware is vital to security. Modern smartphones are complicated, with lots of
 
 Apple makes their own SoC on their platforms, which affords them a lot of control over how it works. You can read about how they integrate their hardware tightly on their [Apple Platform Security](https://support.apple.com/guide/security/hardware-security-overview-secf020d1074/web) page.
 
-Apple has started to replace other components as well, with their newest phones boasting their N1 wireless chip that handles WiFi, Bluetooth, and Thread connectivity as well as their in-house cellular modem. Apple has a lot of control over the components in their phones which avoids supply-chain issues that other OEMs run into, with each third-party component relying on a third party to [patch security vulnerabilities](https://www.binarly.io/blog/the-firmware-supply-chain-security-is-broken-can-we-fix-it) and fix bugs in their firmware.
+Apple has started to replace other components as well, with their newest phones boasting their N1 wireless chip that handles WiFi, Bluetooth, and Thread connectivity as well as their in-house cellular modem. Apple has a lot of control over the components in their phones which avoids supply-chain issues that other OEMs run into, with each third-party component relying on a third party to [patch security vulnerabilities](https://binarly.io/blog/the-firmware-supply-chain-security-is-broken-can-we-fix-it) and fix bugs in their firmware.
 
 ![Graphic showing the supply chain of various OEMs, and Apple bypassing the whole supply chain because they use their own firmware and hardware](../assets/images/ios-vs-android/binarly-graphic.png)
 
-<small aria-hidden="true">Photo: [Binarly](https://www.binarly.io/blog/the-firmware-supply-chain-security-is-broken-can-we-fix-it)</small>
+<small aria-hidden="true">Photo: [Binarly](https://binarly.io/blog/the-firmware-supply-chain-security-is-broken-can-we-fix-it)</small>
 
 Apple can deal with vulnerabilities themselves when they're reported instead of waiting for a third party to fix it. According to their [docs](https://support.apple.com/guide/security/peripheral-processor-security-seca500d4f2b/1/web/1):
 
@@ -60,7 +60,7 @@ Apple can deal with vulnerabilities themselves when they're reported instead of
 
 They take care to reduce attack surface by disabling debug interfaces and signing the firmware with keys stored in Apple's own hardware security modules.
 
-Apple also supports all the important hardware security features you'd want, like a [Secure Element](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) for secure cryptography and secret storage, secure [biometric hardware](https://support.apple.com/guide/security/biometric-security-sec067eb0c9e/1/web/1) including 3D face scans for Face ID, hardware-backed [indicator lights](https://theapplewiki.com/wiki/Secure_Indicator_Light) for camera and microphone, [hardware killswitches](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/1/web/1) for the microphone on iPads, and [MTE](https://security.apple.com/blog/memory-integrity-enforcement/) for their latest iPhones.
+Apple also supports all the important hardware security features you'd want, like a [Secure Element](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) for secure cryptography and secret storage, secure [biometric hardware](https://support.apple.com/guide/security/biometric-security-sec067eb0c9e/1/web/1) including 3D face scans for Face ID, hardware-backed [indicator lights](https://theapplewiki.com/wiki/Secure_Indicator_Light) for camera and microphone, [hardware killswitches](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/1/web/1) for the microphone on iPads, and [MTE](https://security.apple.com/blog/memory-integrity-enforcement) for their latest iPhones.
 
 Processors that deal with networking are isolated via an [IOMMU](https://support.apple.com/guide/security/security-features-connecting-wireless-sec8a67fa93d/1/web/1#sec7e0184776) so that they can't access each others' memory.
 
@@ -78,15 +78,15 @@ Android and iOS have very different approaches in terms of downloading and acqui
 
 ### iOS
 
-iOS restricts app downloads to their own App Store. Apple claims this is for security purposes, but it restricts user freedom and makes it possible for Apple to [censor](https://9to5mac.com/2024/09/28/apple-cooperating-with-russia-to-remove-vpn-apps-from-app-store/) apps in certain regions.
+iOS restricts app downloads to their own App Store. Apple claims this is for security purposes, but it restricts user freedom and makes it possible for Apple to [censor](https://9to5mac.com/2024/09/28/apple-cooperating-with-russia-to-remove-vpn-apps-from-app-store) apps in certain regions.
 
-The App Store does enforce certain [security](https://support.apple.com/guide/security/about-app-store-security-secb8f887a15/1/web/1) properties, mainly through the App Review process. This process can't catch everything though, and [malware](https://securelist.com/sparkcat-stealer-in-app-store-and-google-play/115385/) still slips through the cracks.
+The App Store does enforce certain [security](https://support.apple.com/guide/security/about-app-store-security-secb8f887a15/1/web/1) properties, mainly through the App Review process. This process can't catch everything though, and [malware](https://securelist.com/sparkcat-stealer-in-app-store-and-google-play/115385) still slips through the cracks.
 
 The lack of third-party app store support means that it's not possible to use an app store with better security properties than the Apple App Store. For example, apps in the App Store have Apple's DRM, which makes reproducible builds [impossible](https://github.com/signalapp/Signal-iOS/issues/641#:~:text=So%20while%20truly%20reproducible%20builds%20are%20not%20possible). If one wanted to use an app store without this security regression, they'd be out of luck.
 
-One positive of the App Store though is they enforce things like a [minimum SDK](https://developer.apple.com/app-store/submitting/) requirement. Apps built targetting earlier SDK's can be missing newer security improvements and potentially have access to more data.
+One positive of the App Store though is they enforce things like a [minimum SDK](https://developer.apple.com/app-store/submitting) requirement. Apps built targetting earlier SDK's can be missing newer security improvements and potentially have access to more data.
 
-In the EU, Apple was forced to allow [third-party app stores](https://developer.apple.com/support/dma-and-apps-in-the-eu/) and sideloading in iOS. In order to accomodate the extra security risk, they implemented the same [notarization](https://developer.apple.com/documentation/Security/notarizing-macos-software-before-distribution) feature from macOS. It would be nice to see them roll this out globally, but it seems to be locked to the EU for now.
+In the EU, Apple was forced to allow [third-party app stores](https://developer.apple.com/support/dma-and-apps-in-the-eu) and sideloading in iOS. In order to accomodate the extra security risk, they implemented the same [notarization](https://developer.apple.com/documentation/Security/notarizing-macos-software-before-distribution) feature from macOS. It would be nice to see them roll this out globally, but it seems to be locked to the EU for now.
 
 ### Android
 

From 10d2844161b960bae41593b00b0353848afbe0c9 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 12:22:27 -0500
Subject: [PATCH 04/68] add alternate OS support

---
 blog/posts/ios-vs-android.md | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 985e626d..23f84b72 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -102,3 +102,30 @@ Because of Android's support for third-party app stores, it's possible to use an
 
 Accrescent allows for developers to control their own signing keys, and doesn't require an account, among other improvements. This is an improvement over the Google Play Store where Google controls the signing keys and you need a Google account to use it.
 
+## Alternate OS Support
+
+Support for installing alternate operating systems isn't just important for user freedom, it's needed so that third parties can make thier own, more secure and more private operating systems than what comes pre-installed.
+
+### iOS
+
+In order to install any apps or use many features on iOS, you need an [Apple Account](https://account.apple.com). Apple Accounts ask for your real name and require a phone number to use, on top of tying your app and other purchases to an account. While iOS is known to be privacy-friendly, Apple's [privacy policy](https://www.apple.com/legal/privacy/en-ww/) leaves a lot to be desired.
+
+iOS doesn't allow you to unlock the bootloader to install another operating system. While [jailbreaking](https://en.wikipedia.org/wiki/IOS_jailbreaking) is possible, it requires exploiting your device and ultimately your security will be much worse.
+
+iOS should allow for fully unlocking and relocking the bootloader for alternate operating systems, so a version of iOS without any user data being sent to Apple can be installed.
+
+This goes along with open sourcing their OS as well. When Apple eventually drops support for devices, it would be good to still be able to get updates through a third-party OS, although they wouldn't be able to update the firmware.
+
+Alternate OS's can also allow people to more fully utilize the hardware security features. For example, the [MTE](https://security.apple.com/blog/memory-integrity-enforcement/) support in newer iPhones currently doesn't cover everything in the OS, just "the kernel and over 70 userland processes" as well as being optional for app developers to enable. An alternate OS could be more strict and enable it for everything in the OS as well as apps by default, with a toggle to disable it if they crash.
+
+### Android
+
+While on paper Android is much more free in this regard, many OEMs don't properly support fully unlocking and relocking the bootloader. Google Pixels are really your only option on Android in this regard.
+
+The open nature of Android is ruined a bit by most of the OEMs, like [Samsung](https://x.com/GrapheneOS/status/1960374409572610192#m).
+
+GrapheneOS is probably the best example of what an alternate OS can achieve. They've made [significant security improvements](https://grapheneos.org/features) over the default Pixel OS and AOSP.
+
+GrapheneOS utilizes hardware features like MTE, which is locked behind [Advanced Protection](https://support.google.com/accounts/answer/9764949?hl=en) normally, by default and with significantly [more coverage](https://x.com/GrapheneOS/status/1965810573066768865#m).
+
+They also disable USB at the [hardware level](https://grapheneos.org/features#usb-c-port-and-pogo-pins-control). This is a demonstrable security improvement, as forensics companies like [Cellebrite](https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation) have leaked documentation showing they're not able to get into GrapheneOS devices above a 2022 patch level.
\ No newline at end of file

From b25b9f4e6726e7dc84c1ca83f3a4f82fd6209c0c Mon Sep 17 00:00:00 2001
From: Jonah Aragon <jonah@privacyguides.org>
Date: Fri, 26 Sep 2025 14:52:41 -0500
Subject: [PATCH 05/68] update timestamp

---
 blog/posts/ios-vs-android.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 23f84b72..dc97d78e 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -1,6 +1,6 @@
 ---
 date:
-    created: 2025-05-19T20:15:00Z
+    created: 2025-09-27T17:00:00Z
 categories:
     - Opinion
 authors:
@@ -12,7 +12,7 @@ tags:
 preview:
 ---
 
-# iOS vs Android Security: What Each Can Learn from the Other
+# iOS vs Android Security: What They Can Learn From Each Other
 
 Both Android and iOS run on the vast majority of our mobile devices, meaning they are entrusted with our most sensitive data. While they trade blows, there are areas where the two differ in security features and philosophy.<!-- more -->
 
@@ -26,7 +26,7 @@ iOS is a closed-source operating system, but it's based on the open-source [XNU
 
 It's important to note that being open-source doesn't [inherently make software secure](https://seirdy.one/posts/2022/02/02/floss-security), but it can be helpful for anyone wanting to audit the code.
 
-I'd like to see Apple realease its entire operating system as open source in order to foster a spirit of openness and allow for [reproducible builds](https://reproducible-builds.org), allowing third parties to verify that the downloaded binaries match the released source code. As of now, that's impossible thanks to iOS's closed nature. A fully open-source iOS would also be the first step in third-party 
+I'd like to see Apple realease its entire operating system as open source in order to foster a spirit of openness and allow for [reproducible builds](https://reproducible-builds.org), allowing third parties to verify that the downloaded binaries match the released source code. As of now, that's impossible thanks to iOS's closed nature. A fully open-source iOS would also be the first step in third-party
 
 ### Android
 
@@ -128,4 +128,4 @@ GrapheneOS is probably the best example of what an alternate OS can achieve. The
 
 GrapheneOS utilizes hardware features like MTE, which is locked behind [Advanced Protection](https://support.google.com/accounts/answer/9764949?hl=en) normally, by default and with significantly [more coverage](https://x.com/GrapheneOS/status/1965810573066768865#m).
 
-They also disable USB at the [hardware level](https://grapheneos.org/features#usb-c-port-and-pogo-pins-control). This is a demonstrable security improvement, as forensics companies like [Cellebrite](https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation) have leaked documentation showing they're not able to get into GrapheneOS devices above a 2022 patch level.
\ No newline at end of file
+They also disable USB at the [hardware level](https://grapheneos.org/features#usb-c-port-and-pogo-pins-control). This is a demonstrable security improvement, as forensics companies like [Cellebrite](https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation) have leaked documentation showing they're not able to get into GrapheneOS devices above a 2022 patch level.

From 3b6d03ba24fbc89589306350be9b96b2359ada70 Mon Sep 17 00:00:00 2001
From: Jonah Aragon <jonah@privacyguides.org>
Date: Fri, 26 Sep 2025 14:56:55 -0500
Subject: [PATCH 06/68] Spell/grammar pass

---
 blog/posts/ios-vs-android.md | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index dc97d78e..1cba58f7 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -26,13 +26,13 @@ iOS is a closed-source operating system, but it's based on the open-source [XNU
 
 It's important to note that being open-source doesn't [inherently make software secure](https://seirdy.one/posts/2022/02/02/floss-security), but it can be helpful for anyone wanting to audit the code.
 
-I'd like to see Apple realease its entire operating system as open source in order to foster a spirit of openness and allow for [reproducible builds](https://reproducible-builds.org), allowing third parties to verify that the downloaded binaries match the released source code. As of now, that's impossible thanks to iOS's closed nature. A fully open-source iOS would also be the first step in third-party
+I'd like to see Apple release its entire operating system as open source in order to foster a spirit of openness and allow for [reproducible builds](https://reproducible-builds.org), allowing third parties to verify that the downloaded binaries match the released source code. As of now, that's impossible thanks to iOS's closed nature. A fully open-source iOS would also be the first step in third-party
 
 ### Android
 
 The beating heart of Android is the [Android Open Source Project](https://source.android.com) (AOSP). AOSP is essentially a complete open-source mobile operating system on its own. Android was designed from the beginning to be used by lots of different companies for their own mobile phone offerings, so the open nature is useful toward that goal.
 
-However, AOSP is only a barebones operating system. OEMs are expected to add their own proprietary components to make their own, custom user experience. This is why most Android phones you buy are full of proprietary software like Facebook and other OEM software; companies that sell Android phones mainly use AOSP as a secure base to then run on their phones with proprietary drivers and their own custom Android. While the openness of AOSP is great, the OEMs making the phones ultimately ruin it.
+However, AOSP is only a bare-bones operating system. OEMs are expected to add their own proprietary components to make their own, custom user experience. This is why most Android phones you buy are full of proprietary software like Facebook and other OEM software; companies that sell Android phones mainly use AOSP as a secure base to then run on their phones with proprietary drivers and their own custom Android. While the openness of AOSP is great, the OEMs making the phones ultimately ruin it.
 
 Because AOSP is open source though, non-OEM third parties such as [GrapheneOS](https://grapheneos.org) have made their own fully open-source Android operating systems. GrapheneOS supports [reproducible builds](https://grapheneos.org/build#reproducible-builds).
 
@@ -42,13 +42,13 @@ A problem inherent to being downstream of AOSP, third-party operating systems al
 
 ## Hardware
 
-Hardware is vital to security. Modern smartphones are complicated, with lots of different processors and components, all runnng their own firmware and with their own potential security vulnerabilities. It's important to lock down these components as much as possible.
+Hardware is vital to security. Modern smartphones are complicated, with lots of different processors and components, all running their own firmware and with their own potential security vulnerabilities. It's important to lock down these components as much as possible.
 
 ### iOS
 
 Apple makes their own SoC on their platforms, which affords them a lot of control over how it works. You can read about how they integrate their hardware tightly on their [Apple Platform Security](https://support.apple.com/guide/security/hardware-security-overview-secf020d1074/web) page.
 
-Apple has started to replace other components as well, with their newest phones boasting their N1 wireless chip that handles WiFi, Bluetooth, and Thread connectivity as well as their in-house cellular modem. Apple has a lot of control over the components in their phones which avoids supply-chain issues that other OEMs run into, with each third-party component relying on a third party to [patch security vulnerabilities](https://binarly.io/blog/the-firmware-supply-chain-security-is-broken-can-we-fix-it) and fix bugs in their firmware.
+Apple has started to replace other components as well, with their newest phones boasting their N1 wireless chip that handles Wi-Fi, Bluetooth, and Thread connectivity as well as their in-house cellular modem. Apple has a lot of control over the components in their phones which avoids supply-chain issues that other OEMs run into, with each third-party component relying on a third party to [patch security vulnerabilities](https://binarly.io/blog/the-firmware-supply-chain-security-is-broken-can-we-fix-it) and fix bugs in their firmware.
 
 ![Graphic showing the supply chain of various OEMs, and Apple bypassing the whole supply chain because they use their own firmware and hardware](../assets/images/ios-vs-android/binarly-graphic.png)
 
@@ -60,9 +60,9 @@ Apple can deal with vulnerabilities themselves when they're reported instead of
 
 They take care to reduce attack surface by disabling debug interfaces and signing the firmware with keys stored in Apple's own hardware security modules.
 
-Apple also supports all the important hardware security features you'd want, like a [Secure Element](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) for secure cryptography and secret storage, secure [biometric hardware](https://support.apple.com/guide/security/biometric-security-sec067eb0c9e/1/web/1) including 3D face scans for Face ID, hardware-backed [indicator lights](https://theapplewiki.com/wiki/Secure_Indicator_Light) for camera and microphone, [hardware killswitches](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/1/web/1) for the microphone on iPads, and [MTE](https://security.apple.com/blog/memory-integrity-enforcement) for their latest iPhones.
+Apple also supports all the important hardware security features you'd want, like a [Secure Element](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) for secure cryptography and secret storage, secure [biometric hardware](https://support.apple.com/guide/security/biometric-security-sec067eb0c9e/1/web/1) including 3D face scans for Face ID, hardware-backed [indicator lights](https://theapplewiki.com/wiki/Secure_Indicator_Light) for camera and microphone, [hardware kill switches](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/1/web/1) for the microphone on iPads, and [MTE](https://security.apple.com/blog/memory-integrity-enforcement) for their latest iPhones.
 
-Processors that deal with networking are isolated via an [IOMMU](https://support.apple.com/guide/security/security-features-connecting-wireless-sec8a67fa93d/1/web/1#sec7e0184776) so that they can't access each others' memory.
+Processors that deal with networking are isolated via an [IOMMU](https://support.apple.com/guide/security/security-features-connecting-wireless-sec8a67fa93d/1/web/1#sec7e0184776) so that they can't access each other's memory.
 
 Overall, Apple does an excellent job with hardware security, most Android OEMs could stand to learn from them.
 
@@ -84,15 +84,15 @@ The App Store does enforce certain [security](https://support.apple.com/guide/se
 
 The lack of third-party app store support means that it's not possible to use an app store with better security properties than the Apple App Store. For example, apps in the App Store have Apple's DRM, which makes reproducible builds [impossible](https://github.com/signalapp/Signal-iOS/issues/641#:~:text=So%20while%20truly%20reproducible%20builds%20are%20not%20possible). If one wanted to use an app store without this security regression, they'd be out of luck.
 
-One positive of the App Store though is they enforce things like a [minimum SDK](https://developer.apple.com/app-store/submitting) requirement. Apps built targetting earlier SDK's can be missing newer security improvements and potentially have access to more data.
+One positive of the App Store though is they enforce things like a [minimum SDK](https://developer.apple.com/app-store/submitting) requirement. Apps built targeting earlier SDK's can be missing newer security improvements and potentially have access to more data.
 
-In the EU, Apple was forced to allow [third-party app stores](https://developer.apple.com/support/dma-and-apps-in-the-eu) and sideloading in iOS. In order to accomodate the extra security risk, they implemented the same [notarization](https://developer.apple.com/documentation/Security/notarizing-macos-software-before-distribution) feature from macOS. It would be nice to see them roll this out globally, but it seems to be locked to the EU for now.
+In the EU, Apple was forced to allow [third-party app stores](https://developer.apple.com/support/dma-and-apps-in-the-eu) and sideloading in iOS. In order to accommodate the extra security risk, they implemented the same [notarization](https://developer.apple.com/documentation/Security/notarizing-macos-software-before-distribution) feature from macOS. It would be nice to see them roll this out globally, but it seems to be locked to the EU for now.
 
 ### Android
 
 Android takes the opposite approach and lets you simply download and run apps from the internet. This gives you much more freedom as a user but could potentially open you up to more malicious apps, for example apps that abuse [accessibility permissions](https://blog.pradeo.com/accessibility-services-mobile-analysis-malware) to gain deep access to your device.
 
-The Google Play Store sets a strict [SDK level requirement](https://developer.android.com/google/play/requirements/target-sdk), but apps downaloaded outside the Google Play Store have much more leniency. Sideloaded apps can target very old SDK levels, which means they won't have the same security restrictions as apps targetting newer SDK's. The biggest restriction that seems to exist in the OS preventing running older SDK's is if an app targets an SDK at or below Android 5.1 (!?) you'll get a warning message. For reference, Android 5 came out in 2014.
+The Google Play Store sets a strict [SDK level requirement](https://developer.android.com/google/play/requirements/target-sdk), but apps downloaded outside the Google Play Store have much more leniency. Sideloaded apps can target very old SDK levels, which means they won't have the same security restrictions as apps targeting newer SDK's. The biggest restriction that seems to exist in the OS preventing running older SDK's is if an app targets an SDK at or below Android 5.1 (!?) you'll get a warning message. For reference, Android 5 came out in 2014.
 
 I think Android could stand to enforce a higher SDK level and simply refuse to run apps that target lower than say a few versions ago. There's no reason to support apps that think they're on Android 5.
 
@@ -100,11 +100,11 @@ GrapheneOS raises the minimum SDK from AOSP.
 
 Because of Android's support for third-party app stores, it's possible to use an app store with superior security to the Google Play Store. [Accrescent](https://accrescent.app) is just such an example.
 
-Accrescent allows for developers to control their own signing keys, and doesn't require an account, among other improvements. This is an improvement over the Google Play Store where Google controls the signing keys and you need a Google account to use it.
+Accrescent allows for developers to control their own signing keys, and doesn't require an account, among other improvements. This is an improvement over the Google Play Store where Google controls the signing keys, and you need a Google account to use it.
 
 ## Alternate OS Support
 
-Support for installing alternate operating systems isn't just important for user freedom, it's needed so that third parties can make thier own, more secure and more private operating systems than what comes pre-installed.
+Support for installing alternate operating systems isn't just important for user freedom, it's needed so that third parties can make their own, more secure and more private operating systems than what comes pre-installed.
 
 ### iOS
 

From 156e98d8e32e6d4c8067c7e6106473057c354290 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 15:13:59 -0500
Subject: [PATCH 07/68] add permissions

---
 blog/posts/ios-vs-android.md | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 1cba58f7..9bb46f07 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -129,3 +129,37 @@ GrapheneOS is probably the best example of what an alternate OS can achieve. The
 GrapheneOS utilizes hardware features like MTE, which is locked behind [Advanced Protection](https://support.google.com/accounts/answer/9764949?hl=en) normally, by default and with significantly [more coverage](https://x.com/GrapheneOS/status/1965810573066768865#m).
 
 They also disable USB at the [hardware level](https://grapheneos.org/features#usb-c-port-and-pogo-pins-control). This is a demonstrable security improvement, as forensics companies like [Cellebrite](https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation) have leaked documentation showing they're not able to get into GrapheneOS devices above a 2022 patch level.
+
+## Permissions
+
+Both operating systems sandbox their apps to prevent access to most of the system, but many things like the camera and microphone are left to users to decide if they allow them or not. iOS and Android differ in what permissions they offer and the granularity of the permissions.
+
+### iOS
+
+iOS has historically been ahead of AOSP in terms of the permissions it offers.
+
+iOS's [paste permission](https://developer.apple.com/documentation/uikit/uipasteboard/) prevents apps from nefariously reading data from your clipboard without your permission, something AOSP lacks still.
+
+iOS added the [Local Network](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) permission in iOS 14, preventing apps from accessing other devices on your local network such as other phones or computers, maybe even network drives with sensitive data on them. Android later [added this permission](https://developer.android.com/privacy-and-security/local-network-permission) in Android 16, albeit currently as opt-in for developers.
+
+Their [contact picker](https://support.apple.com/guide/iphone/control-access-to-contacts-iph9536aa9a5/ios) from iOS 18 allows you to select specific individual contacts you want an app to have access to without giving the app access to your full contact list, a feature which AOSP has yet to implement (although GrapheneOS has a more [granular version](https://grapheneos.org/usage#contact-scopes) of this that they made first).
+
+iOS 26 recently added a [Wired Accessories](https://support.apple.com/en-us/111806) permission as well.
+
+While iOS tends to lead in terms of the sheer number of permissions, they could stand to be more granular. On iOS, once you grant a permission, it tends to stay until you remove it. They have a "one time" option for location, but seemingly not for anything else.
+
+iOS's permissions also tend to lean toward individual apps rather than global permissions. There's no global toggle for the camera or microphone for example like on Android. When you try to disable WiFi or Bluetooth globally through the Control Center on iOS, they won't actually fully disable: you need to go to the settings in order to properly disable them (unless you have Airplane Mode on for some reason).
+
+There's also the matter of some permissions only being available in certain regions, like apparently Chinese iPhones have a granular [network permission](https://sspai.com/post/35720) that can allow you grant specific apps network access. This would be a huge security improvement on iOS, and it's a feature that's already been implemented so it's quite confusing why they wouldn't ship this feature globally.
+
+These permissions might protect you from third-party apps, but Apple's own apps can actually [bypass the system permissions](https://blog.xpnsec.com/bypassing-macos-privacy-controls/#:~:text=A%20quick%20review%20of%20Calendar's,How%20can%20we%20subvert%20this?). Allowing their own apps privileged access in the system is, in my opinion, both a privacy and security issue. This means that any Apple app could access your camera, microphone, etc without you knowing about it. I'd like to see Apple not make their own apps privileged, I think that would make users more comfortable and give them more controll over their system.
+
+### Android
+
+Android's permissions tend to lag behind iOS, but they usually end up implementing them in the end. The strength on Android is the global toggles for things like camera and microphone, and much wider use of "one time" permissions.
+
+GrapheneOS greatly expands on the permissions AOSP offers, giving highly granular options such as [Contact Scopes](https://grapheneos.org/usage#contact-scopes) that allow you not only to pick what specific contacts you want, but also specific information from each contact.
+
+GrapheneOS also implements a user-facing Network permission allowing apps to individually be granted network access.
+
+You would think with examples of these features already being implemented on *their own platform*, AOSP would go ahead and add them, but that doesn't seem to be the case. I'd like to see Android implement equivalent versions of these permissions to what GrapheneOS offers, the research and development work has already been done on how they should work, they just need to copy it.

From 871960eac35c98a7d6d09d6711f126511fa50fc0 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 15:23:49 -0500
Subject: [PATCH 08/68] fix unfinished sentence

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 9bb46f07..3a2a9bf5 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -26,7 +26,7 @@ iOS is a closed-source operating system, but it's based on the open-source [XNU
 
 It's important to note that being open-source doesn't [inherently make software secure](https://seirdy.one/posts/2022/02/02/floss-security), but it can be helpful for anyone wanting to audit the code.
 
-I'd like to see Apple release its entire operating system as open source in order to foster a spirit of openness and allow for [reproducible builds](https://reproducible-builds.org), allowing third parties to verify that the downloaded binaries match the released source code. As of now, that's impossible thanks to iOS's closed nature. A fully open-source iOS would also be the first step in third-party
+I'd like to see Apple release its entire operating system as open source in order to foster a spirit of openness and allow for [reproducible builds](https://reproducible-builds.org), allowing third parties to verify that the downloaded binaries match the released source code. As of now, that's impossible thanks to iOS's closed nature. A fully open-source iOS would also be the first step in third-party operating system support on the platform.
 
 ### Android
 

From 730ffd69da373018fb1217b56778c7c342289ed0 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 21:26:35 -0500
Subject: [PATCH 09/68] add ios security scoped files info

---
 blog/posts/ios-vs-android.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 3a2a9bf5..eecd3242 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -140,6 +140,8 @@ iOS has historically been ahead of AOSP in terms of the permissions it offers.
 
 iOS's [paste permission](https://developer.apple.com/documentation/uikit/uipasteboard/) prevents apps from nefariously reading data from your clipboard without your permission, something AOSP lacks still.
 
+Since iOS 13, apps need to go through the [system file picker](https://developer.apple.com/documentation/uikit/providing-access-to-directories) and are only granted access to the specific files the user allows via a security-scoped URL, they don't gain access to the full filesystem.
+
 iOS added the [Local Network](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) permission in iOS 14, preventing apps from accessing other devices on your local network such as other phones or computers, maybe even network drives with sensitive data on them. Android later [added this permission](https://developer.android.com/privacy-and-security/local-network-permission) in Android 16, albeit currently as opt-in for developers.
 
 Their [contact picker](https://support.apple.com/guide/iphone/control-access-to-contacts-iph9536aa9a5/ios) from iOS 18 allows you to select specific individual contacts you want an app to have access to without giving the app access to your full contact list, a feature which AOSP has yet to implement (although GrapheneOS has a more [granular version](https://grapheneos.org/usage#contact-scopes) of this that they made first).

From 99279dd70b7031701876f0e1ac4bf157a2c94603 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 21:38:16 -0500
Subject: [PATCH 10/68] update wired accessories for ios

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index eecd3242..673df753 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -146,7 +146,7 @@ iOS added the [Local Network](https://developer.apple.com/documentation/technote
 
 Their [contact picker](https://support.apple.com/guide/iphone/control-access-to-contacts-iph9536aa9a5/ios) from iOS 18 allows you to select specific individual contacts you want an app to have access to without giving the app access to your full contact list, a feature which AOSP has yet to implement (although GrapheneOS has a more [granular version](https://grapheneos.org/usage#contact-scopes) of this that they made first).
 
-iOS 26 recently added a [Wired Accessories](https://support.apple.com/en-us/111806) permission as well.
+iOS 26 recently added a [Wired Accessories](https://support.apple.com/en-us/111806) setting as well so you can change how the phone behaves when a wired accessory is connected.
 
 While iOS tends to lead in terms of the sheer number of permissions, they could stand to be more granular. On iOS, once you grant a permission, it tends to stay until you remove it. They have a "one time" option for location, but seemingly not for anything else.
 

From 6a3125422002a3082d439ad48355af6f91d4c38a Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 22:26:21 -0500
Subject: [PATCH 11/68] add apple security research device program

---
 blog/posts/ios-vs-android.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 673df753..1c45f4b2 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -118,6 +118,12 @@ This goes along with open sourcing their OS as well. When Apple eventually drops
 
 Alternate OS's can also allow people to more fully utilize the hardware security features. For example, the [MTE](https://security.apple.com/blog/memory-integrity-enforcement/) support in newer iPhones currently doesn't cover everything in the OS, just "the kernel and over 70 userland processes" as well as being optional for app developers to enable. An alternate OS could be more strict and enable it for everything in the OS as well as apps by default, with a toggle to disable it if they crash.
 
+Apple's refusal to allow rooting iPhones also stifles security researchers' ability to do their work, many of them having to resort to exploiting the phone just to have the access they need.
+
+Apple's [Security Research Device](https://security.apple.com/research-device/) program is an acknowledgement of this problem. It offers built-in access to make security research much easier. However, it's only offered as a "12-month renewable loan" (meaning you never own the device) and is only available to people with "a proven track record of success in finding security issues on Apple platforms, or other modern operating systems and platforms". This means if you're not already an established security researcher, you won't have access to it.
+
+In my opinion, this strict locking down of the platform stifles up-and-coming security researchers. Apple should allow users to root their devices if they want, with a warning about the security implications.
+
 ### Android
 
 While on paper Android is much more free in this regard, many OEMs don't properly support fully unlocking and relocking the bootloader. Google Pixels are really your only option on Android in this regard.

From 12192f16956e5e042b9f2c553b12bd3a3c668c90 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 22:31:24 -0500
Subject: [PATCH 12/68] change "root" to unlock bootloader

---
 blog/posts/ios-vs-android.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 1c45f4b2..7e16d1a0 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -118,11 +118,11 @@ This goes along with open sourcing their OS as well. When Apple eventually drops
 
 Alternate OS's can also allow people to more fully utilize the hardware security features. For example, the [MTE](https://security.apple.com/blog/memory-integrity-enforcement/) support in newer iPhones currently doesn't cover everything in the OS, just "the kernel and over 70 userland processes" as well as being optional for app developers to enable. An alternate OS could be more strict and enable it for everything in the OS as well as apps by default, with a toggle to disable it if they crash.
 
-Apple's refusal to allow rooting iPhones also stifles security researchers' ability to do their work, many of them having to resort to exploiting the phone just to have the access they need.
+Apple's refusal to allow unlocking the bootloader on iPhones also stifles security researchers' ability to do their work, many of them having to resort to exploiting the phone just to have the access they need.
 
 Apple's [Security Research Device](https://security.apple.com/research-device/) program is an acknowledgement of this problem. It offers built-in access to make security research much easier. However, it's only offered as a "12-month renewable loan" (meaning you never own the device) and is only available to people with "a proven track record of success in finding security issues on Apple platforms, or other modern operating systems and platforms". This means if you're not already an established security researcher, you won't have access to it.
 
-In my opinion, this strict locking down of the platform stifles up-and-coming security researchers. Apple should allow users to root their devices if they want, with a warning about the security implications.
+In my opinion, this strict locking down of the platform stifles up-and-coming security researchers. Apple should allow users to unlock the bootloader on their devices if they want, with a warning about the security implications.
 
 ### Android
 

From 5530f6522705a325012cbfd24a97e0c21f22f7af Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 22:31:59 -0500
Subject: [PATCH 13/68] add link for unlocking bootloader

---
 blog/posts/ios-vs-android.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 7e16d1a0..e672012d 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -126,7 +126,7 @@ In my opinion, this strict locking down of the platform stifles up-and-coming se
 
 ### Android
 
-While on paper Android is much more free in this regard, many OEMs don't properly support fully unlocking and relocking the bootloader. Google Pixels are really your only option on Android in this regard.
+While on paper Android is much more free in this regard, many OEMs don't properly support fully [unlocking and relocking](https://source.android.com/docs/core/architecture/bootloader/locking_unlocking) the bootloader. Google Pixels are really your only option on Android in this regard.
 
 The open nature of Android is ruined a bit by most of the OEMs, like [Samsung](https://x.com/GrapheneOS/status/1960374409572610192#m).
 
@@ -136,6 +136,8 @@ GrapheneOS utilizes hardware features like MTE, which is locked behind [Advanced
 
 They also disable USB at the [hardware level](https://grapheneos.org/features#usb-c-port-and-pogo-pins-control). This is a demonstrable security improvement, as forensics companies like [Cellebrite](https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation) have leaked documentation showing they're not able to get into GrapheneOS devices above a 2022 patch level.
 
+
+
 ## Permissions
 
 Both operating systems sandbox their apps to prevent access to most of the system, but many things like the camera and microphone are left to users to decide if they allow them or not. iOS and Android differ in what permissions they offer and the granularity of the permissions.

From 109478a0aa6ab88d57d64ad57df11c4c7814cc1c Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 22:36:29 -0500
Subject: [PATCH 14/68] add security research to android section

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index e672012d..8cf28722 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -136,7 +136,7 @@ GrapheneOS utilizes hardware features like MTE, which is locked behind [Advanced
 
 They also disable USB at the [hardware level](https://grapheneos.org/features#usb-c-port-and-pogo-pins-control). This is a demonstrable security improvement, as forensics companies like [Cellebrite](https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation) have leaked documentation showing they're not able to get into GrapheneOS devices above a 2022 patch level.
 
-
+The ability to unlock the bootloader on Android devices is a huge boon for security research as well.
 
 ## Permissions
 

From 18fe537b0cb2fe172cdea27cee36494401e96dc3 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 26 Sep 2025 23:42:34 -0500
Subject: [PATCH 15/68] add google play services

---
 blog/posts/ios-vs-android.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 8cf28722..95625481 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -173,3 +173,5 @@ GrapheneOS greatly expands on the permissions AOSP offers, giving highly granula
 GrapheneOS also implements a user-facing Network permission allowing apps to individually be granted network access.
 
 You would think with examples of these features already being implemented on *their own platform*, AOSP would go ahead and add them, but that doesn't seem to be the case. I'd like to see Android implement equivalent versions of these permissions to what GrapheneOS offers, the research and development work has already been done on how they should work, they just need to copy it.
+
+The stock OS you get on your phone suffers from a similar problem as iOS in that Google Play Services are [highly privileged](https://developers.google.com/android/guides/permissions#:~:text=Google%20Play%20services%20automatically%20obtains%20all%20permissions%20it%20needs%20to%20support%20its%20APIs.) in the system. GrapheneOS's [Sandboxed Google Play Services](https://grapheneos.org/features#sandboxed-google-play) provides to option to install it inside the standard app sandbox, preventing it from having any access outside what a normal app would have. This is a massive boost in security and privacy and is how Google Play Services should operate by default.

From ebc7c4eeac2e70e5406c0ca192fd24d10ffdcadc Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sat, 27 Sep 2025 00:33:27 -0500
Subject: [PATCH 16/68] add link to android full filesystem access

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 95625481..d97cff16 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -148,7 +148,7 @@ iOS has historically been ahead of AOSP in terms of the permissions it offers.
 
 iOS's [paste permission](https://developer.apple.com/documentation/uikit/uipasteboard/) prevents apps from nefariously reading data from your clipboard without your permission, something AOSP lacks still.
 
-Since iOS 13, apps need to go through the [system file picker](https://developer.apple.com/documentation/uikit/providing-access-to-directories) and are only granted access to the specific files the user allows via a security-scoped URL, they don't gain access to the full filesystem.
+Since iOS 13, apps need to go through the [system file picker](https://developer.apple.com/documentation/uikit/providing-access-to-directories) and are only granted access to the specific files the user allows via a security-scoped URL, they don't gain access to the full filesystem like apps can on [Android](https://developer.android.com/training/data-storage/manage-all-files#:~:text=Android%20provides%20a%20special%20app%20access%20called%20all%2Dfiles%20access%20for%20these%20situations.).
 
 iOS added the [Local Network](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) permission in iOS 14, preventing apps from accessing other devices on your local network such as other phones or computers, maybe even network drives with sensitive data on them. Android later [added this permission](https://developer.android.com/privacy-and-security/local-network-permission) in Android 16, albeit currently as opt-in for developers.
 

From ca3305e0c8e36371f88edcd312f462129264b823 Mon Sep 17 00:00:00 2001
From: redoomed1 <redoomed1@privacyguides.org>
Date: Sat, 27 Sep 2025 20:25:25 -0700
Subject: [PATCH 17/68] Apply minor suggestions from code review

Signed-off-by: redoomed1 <redoomed1@privacyguides.org>
---
 blog/posts/ios-vs-android.md | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index d97cff16..dacea3a0 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -24,13 +24,13 @@ One of the most glaring differences is the source model of each operating system
 
 iOS is a closed-source operating system, but it's based on the open-source [XNU kernel](https://github.com/apple-oss-distributions/xnu). The kernel handles almost everything on the operating system, so it's good that such a vital component is openly available to examine and do what you want with.
 
-It's important to note that being open-source doesn't [inherently make software secure](https://seirdy.one/posts/2022/02/02/floss-security), but it can be helpful for anyone wanting to audit the code.
+It's important to note that being open source [doesn't inherently make software secure](https://seirdy.one/posts/2022/02/02/floss-security), but it can be helpful for anyone wanting to audit the code.
 
 I'd like to see Apple release its entire operating system as open source in order to foster a spirit of openness and allow for [reproducible builds](https://reproducible-builds.org), allowing third parties to verify that the downloaded binaries match the released source code. As of now, that's impossible thanks to iOS's closed nature. A fully open-source iOS would also be the first step in third-party operating system support on the platform.
 
 ### Android
 
-The beating heart of Android is the [Android Open Source Project](https://source.android.com) (AOSP). AOSP is essentially a complete open-source mobile operating system on its own. Android was designed from the beginning to be used by lots of different companies for their own mobile phone offerings, so the open nature is useful toward that goal.
+The beating heart of Android is the [Android Open Source Project](https://source.android.com) (AOSP). AOSP is essentially a complete, open-source mobile OS on its own. Android was designed from the beginning to be used by lots of different companies for each of their own mobile phone offerings, so the open nature is useful toward that goal.
 
 However, AOSP is only a bare-bones operating system. OEMs are expected to add their own proprietary components to make their own, custom user experience. This is why most Android phones you buy are full of proprietary software like Facebook and other OEM software; companies that sell Android phones mainly use AOSP as a secure base to then run on their phones with proprietary drivers and their own custom Android. While the openness of AOSP is great, the OEMs making the phones ultimately ruin it.
 
@@ -56,7 +56,7 @@ Apple has started to replace other components as well, with their newest phones
 
 Apple can deal with vulnerabilities themselves when they're reported instead of waiting for a third party to fix it. According to their [docs](https://support.apple.com/guide/security/peripheral-processor-security-seca500d4f2b/1/web/1):
 
->Whenever possible, Apple works to reduce the number of peripheral processors necessary and to avoid designs that require firmware. But when separate processors with their own firmware are required, efforts are taken to help ensure an attacker can’t persist on that processor.
+> Whenever possible, Apple works to reduce the number of peripheral processors necessary and to avoid designs that require firmware. But when separate processors with their own firmware are required, efforts are taken to help ensure an attacker can’t persist on that processor.
 
 They take care to reduce attack surface by disabling debug interfaces and signing the firmware with keys stored in Apple's own hardware security modules.
 
@@ -64,7 +64,7 @@ Apple also supports all the important hardware security features you'd want, lik
 
 Processors that deal with networking are isolated via an [IOMMU](https://support.apple.com/guide/security/security-features-connecting-wireless-sec8a67fa93d/1/web/1#sec7e0184776) so that they can't access each other's memory.
 
-Overall, Apple does an excellent job with hardware security, most Android OEMs could stand to learn from them.
+Overall, Apple does an excellent job with hardware security. Most Android OEMs could stand to learn from them.
 
 ### Android
 
@@ -90,7 +90,7 @@ In the EU, Apple was forced to allow [third-party app stores](https://developer.
 
 ### Android
 
-Android takes the opposite approach and lets you simply download and run apps from the internet. This gives you much more freedom as a user but could potentially open you up to more malicious apps, for example apps that abuse [accessibility permissions](https://blog.pradeo.com/accessibility-services-mobile-analysis-malware) to gain deep access to your device.
+Android takes the opposite approach and lets you simply download and run apps from the internet. This gives you much more freedom as a user but could potentially open you up to more malicious apps, for example, apps that abuse [accessibility permissions](https://blog.pradeo.com/accessibility-services-mobile-analysis-malware) to gain deep access to your device.
 
 The Google Play Store sets a strict [SDK level requirement](https://developer.android.com/google/play/requirements/target-sdk), but apps downloaded outside the Google Play Store have much more leniency. Sideloaded apps can target very old SDK levels, which means they won't have the same security restrictions as apps targeting newer SDK's. The biggest restriction that seems to exist in the OS preventing running older SDK's is if an app targets an SDK at or below Android 5.1 (!?) you'll get a warning message. For reference, Android 5 came out in 2014.
 
@@ -98,7 +98,7 @@ I think Android could stand to enforce a higher SDK level and simply refuse to r
 
 GrapheneOS raises the minimum SDK from AOSP.
 
-Because of Android's support for third-party app stores, it's possible to use an app store with superior security to the Google Play Store. [Accrescent](https://accrescent.app) is just such an example.
+Because of Android's support for third-party app stores, it's possible to use an app store with superior security to the Google Play Store. [Accrescent](https://accrescent.app) is one such an example.
 
 Accrescent allows for developers to control their own signing keys, and doesn't require an account, among other improvements. This is an improvement over the Google Play Store where Google controls the signing keys, and you need a Google account to use it.
 
@@ -112,21 +112,21 @@ In order to install any apps or use many features on iOS, you need an [Apple Acc
 
 iOS doesn't allow you to unlock the bootloader to install another operating system. While [jailbreaking](https://en.wikipedia.org/wiki/IOS_jailbreaking) is possible, it requires exploiting your device and ultimately your security will be much worse.
 
-iOS should allow for fully unlocking and relocking the bootloader for alternate operating systems, so a version of iOS without any user data being sent to Apple can be installed.
+iOS should allow for fully unlocking and relocking the bootloader for alternate operating systems so that a version of iOS without any user data being sent to Apple can be installed.
 
 This goes along with open sourcing their OS as well. When Apple eventually drops support for devices, it would be good to still be able to get updates through a third-party OS, although they wouldn't be able to update the firmware.
 
-Alternate OS's can also allow people to more fully utilize the hardware security features. For example, the [MTE](https://security.apple.com/blog/memory-integrity-enforcement/) support in newer iPhones currently doesn't cover everything in the OS, just "the kernel and over 70 userland processes" as well as being optional for app developers to enable. An alternate OS could be more strict and enable it for everything in the OS as well as apps by default, with a toggle to disable it if they crash.
+Alternate operating systems can also allow people to more fully utilize the hardware security features. For example, the [MTE](https://security.apple.com/blog/memory-integrity-enforcement) support in newer iPhones currently doesn't cover everything in the OS, just "the kernel and over 70 userland processes," as well as being optional for app developers to enable. An alternate OS could be more strict and enable it for everything in the OS as well as apps by default, with a toggle to disable it if they crash.
 
-Apple's refusal to allow unlocking the bootloader on iPhones also stifles security researchers' ability to do their work, many of them having to resort to exploiting the phone just to have the access they need.
+Apple's refusal to allow unlocking the bootloader on iPhones also stifles security researchers' ability to do their work, with many of them having to resort to exploiting the phone just to have the access they need.
 
-Apple's [Security Research Device](https://security.apple.com/research-device/) program is an acknowledgement of this problem. It offers built-in access to make security research much easier. However, it's only offered as a "12-month renewable loan" (meaning you never own the device) and is only available to people with "a proven track record of success in finding security issues on Apple platforms, or other modern operating systems and platforms". This means if you're not already an established security researcher, you won't have access to it.
+Apple's [Security Research Device](https://security.apple.com/research-device) program is an acknowledgement of this problem. It offers built-in access to make security research much easier. However, it's only offered as a "12-month renewable loan" (meaning you never own the device) and is only available to people with "a proven track record of success in finding security issues on Apple platforms, or other modern operating systems and platforms". This means if you're not already an established security researcher, you won't have access to it.
 
 In my opinion, this strict locking down of the platform stifles up-and-coming security researchers. Apple should allow users to unlock the bootloader on their devices if they want, with a warning about the security implications.
 
 ### Android
 
-While on paper Android is much more free in this regard, many OEMs don't properly support fully [unlocking and relocking](https://source.android.com/docs/core/architecture/bootloader/locking_unlocking) the bootloader. Google Pixels are really your only option on Android in this regard.
+While Android is, on paper, much more free in terms of alternate OS support, many OEMs don't properly support fully [unlocking and relocking](https://source.android.com/docs/core/architecture/bootloader/locking_unlocking) the bootloader. Google Pixels are really your only option on Android in this regard.
 
 The open nature of Android is ruined a bit by most of the OEMs, like [Samsung](https://x.com/GrapheneOS/status/1960374409572610192#m).
 
@@ -146,7 +146,7 @@ Both operating systems sandbox their apps to prevent access to most of the syste
 
 iOS has historically been ahead of AOSP in terms of the permissions it offers.
 
-iOS's [paste permission](https://developer.apple.com/documentation/uikit/uipasteboard/) prevents apps from nefariously reading data from your clipboard without your permission, something AOSP lacks still.
+iOS's [paste permission](https://developer.apple.com/documentation/uikit/uipasteboard) prevents apps from nefariously reading data from your clipboard without your permission, something AOSP lacks still.
 
 Since iOS 13, apps need to go through the [system file picker](https://developer.apple.com/documentation/uikit/providing-access-to-directories) and are only granted access to the specific files the user allows via a security-scoped URL, they don't gain access to the full filesystem like apps can on [Android](https://developer.android.com/training/data-storage/manage-all-files#:~:text=Android%20provides%20a%20special%20app%20access%20called%20all%2Dfiles%20access%20for%20these%20situations.).
 
@@ -160,7 +160,7 @@ While iOS tends to lead in terms of the sheer number of permissions, they could
 
 iOS's permissions also tend to lean toward individual apps rather than global permissions. There's no global toggle for the camera or microphone for example like on Android. When you try to disable WiFi or Bluetooth globally through the Control Center on iOS, they won't actually fully disable: you need to go to the settings in order to properly disable them (unless you have Airplane Mode on for some reason).
 
-There's also the matter of some permissions only being available in certain regions, like apparently Chinese iPhones have a granular [network permission](https://sspai.com/post/35720) that can allow you grant specific apps network access. This would be a huge security improvement on iOS, and it's a feature that's already been implemented so it's quite confusing why they wouldn't ship this feature globally.
+There's also the matter of some permissions only being available in certain regions: Apparently, Chinese iPhones have a granular [network permission](https://sspai.com/post/35720) that can allow you grant specific apps network access. This would be a huge security improvement on iOS, and it's a feature that's already been implemented so it's quite confusing why they wouldn't ship this feature globally.
 
 These permissions might protect you from third-party apps, but Apple's own apps can actually [bypass the system permissions](https://blog.xpnsec.com/bypassing-macos-privacy-controls/#:~:text=A%20quick%20review%20of%20Calendar's,How%20can%20we%20subvert%20this?). Allowing their own apps privileged access in the system is, in my opinion, both a privacy and security issue. This means that any Apple app could access your camera, microphone, etc without you knowing about it. I'd like to see Apple not make their own apps privileged, I think that would make users more comfortable and give them more controll over their system.
 

From d27f27120ae9c250632ad0c7668eb20192fd0469 Mon Sep 17 00:00:00 2001
From: redoomed1 <redoomed1@privacyguides.org>
Date: Sun, 28 Sep 2025 07:17:50 -0700
Subject: [PATCH 18/68] style: Undo slight wording change

Signed-off-by: redoomed1 <redoomed1@privacyguides.org>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index dacea3a0..5f27066e 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -98,7 +98,7 @@ I think Android could stand to enforce a higher SDK level and simply refuse to r
 
 GrapheneOS raises the minimum SDK from AOSP.
 
-Because of Android's support for third-party app stores, it's possible to use an app store with superior security to the Google Play Store. [Accrescent](https://accrescent.app) is one such an example.
+Because of Android's support for third-party app stores, it's possible to use an app store with superior security to the Google Play Store. [Accrescent](https://accrescent.app) is just such an example.
 
 Accrescent allows for developers to control their own signing keys, and doesn't require an account, among other improvements. This is an improvement over the Google Play Store where Google controls the signing keys, and you need a Google account to use it.
 

From 890795bbd42980acb183a1012721d106fdcfc877 Mon Sep 17 00:00:00 2001
From: redoomed1 <redoomed1@privacyguides.org>
Date: Sun, 28 Sep 2025 07:19:54 -0700
Subject: [PATCH 19/68] style: Fix typo

Signed-off-by: redoomed1 <redoomed1@privacyguides.org>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 5f27066e..5771056b 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -162,7 +162,7 @@ iOS's permissions also tend to lean toward individual apps rather than global pe
 
 There's also the matter of some permissions only being available in certain regions: Apparently, Chinese iPhones have a granular [network permission](https://sspai.com/post/35720) that can allow you grant specific apps network access. This would be a huge security improvement on iOS, and it's a feature that's already been implemented so it's quite confusing why they wouldn't ship this feature globally.
 
-These permissions might protect you from third-party apps, but Apple's own apps can actually [bypass the system permissions](https://blog.xpnsec.com/bypassing-macos-privacy-controls/#:~:text=A%20quick%20review%20of%20Calendar's,How%20can%20we%20subvert%20this?). Allowing their own apps privileged access in the system is, in my opinion, both a privacy and security issue. This means that any Apple app could access your camera, microphone, etc without you knowing about it. I'd like to see Apple not make their own apps privileged, I think that would make users more comfortable and give them more controll over their system.
+These permissions might protect you from third-party apps, but Apple's own apps can actually [bypass the system permissions](https://blog.xpnsec.com/bypassing-macos-privacy-controls/#:~:text=A%20quick%20review%20of%20Calendar's,How%20can%20we%20subvert%20this?). Allowing their own apps privileged access in the system is, in my opinion, both a privacy and security issue. This means that any Apple app could access your camera, microphone, etc without you knowing about it. I'd like to see Apple not make their own apps privileged, I think that would make users more comfortable and give them more control over their system.
 
 ### Android
 

From 0e3553a90d274186cb1f8cacf9ff1495c42eed18 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 28 Sep 2025 09:21:48 -0500
Subject: [PATCH 20/68] wording/capitalization

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 5771056b..eb9f7cd2 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -174,4 +174,4 @@ GrapheneOS also implements a user-facing Network permission allowing apps to ind
 
 You would think with examples of these features already being implemented on *their own platform*, AOSP would go ahead and add them, but that doesn't seem to be the case. I'd like to see Android implement equivalent versions of these permissions to what GrapheneOS offers, the research and development work has already been done on how they should work, they just need to copy it.
 
-The stock OS you get on your phone suffers from a similar problem as iOS in that Google Play Services are [highly privileged](https://developers.google.com/android/guides/permissions#:~:text=Google%20Play%20services%20automatically%20obtains%20all%20permissions%20it%20needs%20to%20support%20its%20APIs.) in the system. GrapheneOS's [Sandboxed Google Play Services](https://grapheneos.org/features#sandboxed-google-play) provides to option to install it inside the standard app sandbox, preventing it from having any access outside what a normal app would have. This is a massive boost in security and privacy and is how Google Play Services should operate by default.
+The stock OS pre-installed on an Android phone suffers from a similar problem as iOS on an iPhone in that Google Play Services are [highly privileged](https://developers.google.com/android/guides/permissions#:~:text=Google%20Play%20services%20automatically%20obtains%20all%20permissions%20it%20needs%20to%20support%20its%20APIs.) in the OS. GrapheneOS's [sandboxed Google Play Services](https://grapheneos.org/features#sandboxed-google-play) provides to option to install it inside the standard app sandbox, preventing it from having any access outside what a normal app would have. This is a massive boost in security and privacy and is how Google Play Services should operate by default.

From 89c26509ee7d2e9b7612c21a82d6ca795af70ee9 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 28 Sep 2025 09:23:07 -0500
Subject: [PATCH 21/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index eb9f7cd2..c1da3d8b 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -170,7 +170,7 @@ Android's permissions tend to lag behind iOS, but they usually end up implementi
 
 GrapheneOS greatly expands on the permissions AOSP offers, giving highly granular options such as [Contact Scopes](https://grapheneos.org/usage#contact-scopes) that allow you not only to pick what specific contacts you want, but also specific information from each contact.
 
-GrapheneOS also implements a user-facing Network permission allowing apps to individually be granted network access.
+GrapheneOS also implements a user-facing Network permission which allows you to grant network access to individual apps.
 
 You would think with examples of these features already being implemented on *their own platform*, AOSP would go ahead and add them, but that doesn't seem to be the case. I'd like to see Android implement equivalent versions of these permissions to what GrapheneOS offers, the research and development work has already been done on how they should work, they just need to copy it.
 

From 8a4bf229fc03a2f7b7dbb2059d3324634ccadb6b Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 28 Sep 2025 09:23:44 -0500
Subject: [PATCH 22/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index c1da3d8b..f0e8528c 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -22,7 +22,7 @@ One of the most glaring differences is the source model of each operating system
 
 ### iOS
 
-iOS is a closed-source operating system, but it's based on the open-source [XNU kernel](https://github.com/apple-oss-distributions/xnu). The kernel handles almost everything on the operating system, so it's good that such a vital component is openly available to examine and do what you want with.
+iOS is a closed-source OS, but it's based on the open-source [XNU kernel](https://github.com/apple-oss-distributions/xnu). The kernel handles almost everything on the OS, so it's good that such a vital component is openly available to examine and test.
 
 It's important to note that being open source [doesn't inherently make software secure](https://seirdy.one/posts/2022/02/02/floss-security), but it can be helpful for anyone wanting to audit the code.
 

From 7815c9ef0269eeadf4ef41ea655f88d89e05af2c Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 28 Sep 2025 15:13:44 -0500
Subject: [PATCH 23/68] add profile info

---
 blog/posts/ios-vs-android.md | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index f0e8528c..c0e1d2b5 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -170,8 +170,28 @@ Android's permissions tend to lag behind iOS, but they usually end up implementi
 
 GrapheneOS greatly expands on the permissions AOSP offers, giving highly granular options such as [Contact Scopes](https://grapheneos.org/usage#contact-scopes) that allow you not only to pick what specific contacts you want, but also specific information from each contact.
 
-GrapheneOS also implements a user-facing Network permission which allows you to grant network access to individual apps.
+GrapheneOS also implements a user-facing [Network permission](https://grapheneos.org/features#network-permission-toggle) allowing apps to individually be granted network access.
 
 You would think with examples of these features already being implemented on *their own platform*, AOSP would go ahead and add them, but that doesn't seem to be the case. I'd like to see Android implement equivalent versions of these permissions to what GrapheneOS offers, the research and development work has already been done on how they should work, they just need to copy it.
 
 The stock OS pre-installed on an Android phone suffers from a similar problem as iOS on an iPhone in that Google Play Services are [highly privileged](https://developers.google.com/android/guides/permissions#:~:text=Google%20Play%20services%20automatically%20obtains%20all%20permissions%20it%20needs%20to%20support%20its%20APIs.) in the OS. GrapheneOS's [sandboxed Google Play Services](https://grapheneos.org/features#sandboxed-google-play) provides to option to install it inside the standard app sandbox, preventing it from having any access outside what a normal app would have. This is a massive boost in security and privacy and is how Google Play Services should operate by default.
+
+## Profiles
+
+Support for separate user profiles allows for strong separation of activities, similar to how different browser profiles allow you to separate your browsing.
+
+### iOS
+
+iOS doesn't allow for separate profiles. This is a major detriment on iOS as Android does support separate profiles, each encrypted with a separate encryption key..
+
+iOS could benefit massively from introducing multiple user profiles. Apple has already implemented the feature on [iPadOS](https://support.apple.com/guide/deployment/shared-ipad-overview-dep9a34c2ba2/web) but requires the iPad to be supervised.
+
+### Android
+
+Android's support for separate [user profiles](https://source.android.com/docs/devices/admin/multi-user) take great pains to enforce separation of data using separate encryption keys and settings.
+
+It's intending for separate physical people, but it can easily be used to keep one person to keep data separate. Even Android themselves acknowledge this with [work profiles](https://www.android.com/enterprise/work-profile/) allowing businesses to keep their employees' personal data separate from their work data, preventing leakage either direction.
+
+Profiles also form the basis of Android's [Private Space](https://source.android.com/docs/security/features/private-space) feature, which allows you to make a secure silo for sensitive apps and data.
+
+The closest iOS gets is the ability to [lock and hide apps](https://support.apple.com/guide/iphone/lock-or-hide-or-an-app-iph00f208d05/ios), which is useful but not as strong as Android's profiles separation.
\ No newline at end of file

From 64e7d6c526cffda24145e262d254ae7d951c8b5e Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 00:30:44 -0500
Subject: [PATCH 24/68] add insider attack resistance

---
 blog/posts/ios-vs-android.md | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index c0e1d2b5..c0d1b560 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -194,4 +194,18 @@ It's intending for separate physical people, but it can easily be used to keep o
 
 Profiles also form the basis of Android's [Private Space](https://source.android.com/docs/security/features/private-space) feature, which allows you to make a secure silo for sensitive apps and data.
 
-The closest iOS gets is the ability to [lock and hide apps](https://support.apple.com/guide/iphone/lock-or-hide-or-an-app-iph00f208d05/ios), which is useful but not as strong as Android's profiles separation.
\ No newline at end of file
+The closest iOS gets is the ability to [lock and hide apps](https://support.apple.com/guide/iphone/lock-or-hide-or-an-app-iph00f208d05/ios), which is useful but not as strong as Android's profiles separation.
+
+## Insider Attack Resistance
+
+Both Android and iOS are highly secure against attacks on firmware and internal components thanks to their use of signatures to verify that the firmware is made by the OEM. But what if the attacker has access to the signing keys?
+
+### iOS
+
+Apple makes no mention of a feature protecting against insider attacks that I could find, which seems like a big omission. I think it's clear that you're expected to trust Apple fully on iOS, which is fair but I think it limits what security features they're willing to implement sometimes.
+
+### Android
+
+Android on the other hand implements [insider attack resistance](https://android-developers.googleblog.com/2018/05/insider-attack-resistance.html) by preventing the firmware on the secure element from being upgraded unless the correct user password is input.
+
+Specifically, this prevents a targeted malicious update against a specific user from working without the user's cooperation. This is a great security feature and very needed in a world where governments have tried to coerce companies into pushing a [targeted malicious update](https://www.apple.com/customer-letter/) before.
\ No newline at end of file

From d90c3c7a1696ecc4a1b369ad873a20e94bca29d7 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 00:56:22 -0500
Subject: [PATCH 25/68] add browser

---
 blog/posts/ios-vs-android.md | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index c0d1b560..fbb5228d 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -208,4 +208,20 @@ Apple makes no mention of a feature protecting against insider attacks that I co
 
 Android on the other hand implements [insider attack resistance](https://android-developers.googleblog.com/2018/05/insider-attack-resistance.html) by preventing the firmware on the secure element from being upgraded unless the correct user password is input.
 
-Specifically, this prevents a targeted malicious update against a specific user from working without the user's cooperation. This is a great security feature and very needed in a world where governments have tried to coerce companies into pushing a [targeted malicious update](https://www.apple.com/customer-letter/) before.
\ No newline at end of file
+Specifically, this prevents a targeted malicious update against a specific user from working without the user's cooperation. This is a great security feature and very needed in a world where governments have tried to coerce companies into pushing a [targeted malicious update](https://www.apple.com/customer-letter/) before.
+
+## Browser
+
+The browser is a major way users are exposed to malware. Your browser runs untrusted code from multiple sources constantly, and any vulnerability could yield a treasure trove of data including bank account session tokens and passwords.
+
+### iOS
+
+On iOS, you're [locked to using WebKit](https://developer.apple.com/app-store/review/guidelines/#:~:text=Apps%20that%20browse%20the%20web%20must%20use%20the%20appropriate%20WebKit%20framework%20and%20WebKit%20JavaScript.). Any other browesr you install is essentially just a reskin of Safari.
+
+Apple did allow [alternate browser engines](https://developer.apple.com/support/alternative-browser-engines/) in the EU, but in other regions you're still locked to using WebKit.
+
+While Safari does offer good [privacy features](https://webkit.org/blog/15697/private-browsing-2-0/), it's lacking some important security protections that other browsers have like [site isolation](https://docs.webkit.org/Deep%20Dive/SiteIsolation.html#finding-what-needs-to-be-done), which they are currently working on implementing but it will be some time before it's done.
+
+Locking users out of other browsers stifles competition and user freedom, not to mention potentially [putting users at risk](https://predictors.fail/#:~:text=As%20pointed%20out%20by%20iLeakage%2C%20Safari%20lacks%20Site%20Isolation%2C%20a%20measure%20used%20to%20enforce%20that%20two%20different%20webpages%20not%20from%20the%20same%20domain%20can%20never%20be%20handled%20by%20the%20same%20process.) by locking them out of using browsers with faster updates and more advanced [security features](https://www.chromium.org/Home/chromium-security/site-isolation/).
+
+Apple should open up their ecosystem to allow for alternate browser engines globally instead of just in the EU.
\ No newline at end of file

From 4885fbae5e4ad2d8034651846e199c60a3d32198 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:30:40 -0500
Subject: [PATCH 26/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index fbb5228d..2572c39e 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -172,7 +172,7 @@ GrapheneOS greatly expands on the permissions AOSP offers, giving highly granula
 
 GrapheneOS also implements a user-facing [Network permission](https://grapheneos.org/features#network-permission-toggle) allowing apps to individually be granted network access.
 
-You would think with examples of these features already being implemented on *their own platform*, AOSP would go ahead and add them, but that doesn't seem to be the case. I'd like to see Android implement equivalent versions of these permissions to what GrapheneOS offers, the research and development work has already been done on how they should work, they just need to copy it.
+You would think with examples of these features already being implemented on *their own platform*, AOSP would go ahead and add them, but that doesn't seem to be the case. I'd like to see Android implement equivalent versions of these permissions to what GrapheneOS offers. GrapheneOS has already developed and tested the permissions; Google just needs to copy them.
 
 The stock OS pre-installed on an Android phone suffers from a similar problem as iOS on an iPhone in that Google Play Services are [highly privileged](https://developers.google.com/android/guides/permissions#:~:text=Google%20Play%20services%20automatically%20obtains%20all%20permissions%20it%20needs%20to%20support%20its%20APIs.) in the OS. GrapheneOS's [sandboxed Google Play Services](https://grapheneos.org/features#sandboxed-google-play) provides to option to install it inside the standard app sandbox, preventing it from having any access outside what a normal app would have. This is a massive boost in security and privacy and is how Google Play Services should operate by default.
 

From b0e0aa9289433a8aa1e927a8ec5c2257647ea856 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:31:46 -0500
Subject: [PATCH 27/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 2572c39e..550d4d90 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -34,7 +34,7 @@ The beating heart of Android is the [Android Open Source Project](https://source
 
 However, AOSP is only a bare-bones operating system. OEMs are expected to add their own proprietary components to make their own, custom user experience. This is why most Android phones you buy are full of proprietary software like Facebook and other OEM software; companies that sell Android phones mainly use AOSP as a secure base to then run on their phones with proprietary drivers and their own custom Android. While the openness of AOSP is great, the OEMs making the phones ultimately ruin it.
 
-Because AOSP is open source though, non-OEM third parties such as [GrapheneOS](https://grapheneos.org) have made their own fully open-source Android operating systems. GrapheneOS supports [reproducible builds](https://grapheneos.org/build#reproducible-builds).
+Because AOSP is open source though, non-OEM third parties such as [GrapheneOS](https://grapheneos.org) have made their own fully open-source Android OS. Unlike stock Android operating systems, GrapheneOS supports [reproducible builds](https://grapheneos.org/build#reproducible-builds).
 
 Many custom AOSP operating systems, while being open source, actually reduce security from AOSP through delayed updates and not supporting important Android security features like [Verified Boot](https://source.android.com/docs/security/features/verifiedboot) (this problem applies to many open source Android operating systems, but not GrapheneOS as they explicitly aim to never downgrade security from AOSP).
 

From 5b87b211bbbefbf5a7bdf7cc69a290901810530e Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:32:39 -0500
Subject: [PATCH 28/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 550d4d90..0e4fd7af 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -38,7 +38,7 @@ Because AOSP is open source though, non-OEM third parties such as [GrapheneOS](h
 
 Many custom AOSP operating systems, while being open source, actually reduce security from AOSP through delayed updates and not supporting important Android security features like [Verified Boot](https://source.android.com/docs/security/features/verifiedboot) (this problem applies to many open source Android operating systems, but not GrapheneOS as they explicitly aim to never downgrade security from AOSP).
 
-A problem inherent to being downstream of AOSP, third-party operating systems also must wait for Google to [ship patches and updates](https://x.com/grapheneos/status/1964561043906048183) for them to apply. Ultimately they are up to the whims of the upstream project which is not ideal.
+One problem custom Android operating systems face is the inherent issue of being [downstream](https://en.wikipedia.org/wiki/Downstream_(software_development)) of AOSP, which means third-party operating systems must wait for the upstream project to ship patches and updates. In this case, AOSP-based operating systems are [at the whim of Google](https://x.com/grapheneos/status/1964561043906048183) for timely security patches and updates, which is not ideal.
 
 ## Hardware
 

From 74866f9b6f1e25ea5740b61c95d21ca842f8d501 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:33:05 -0500
Subject: [PATCH 29/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 0e4fd7af..f932afaf 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -26,7 +26,7 @@ iOS is a closed-source OS, but it's based on the open-source [XNU kernel](https:
 
 It's important to note that being open source [doesn't inherently make software secure](https://seirdy.one/posts/2022/02/02/floss-security), but it can be helpful for anyone wanting to audit the code.
 
-I'd like to see Apple release its entire operating system as open source in order to foster a spirit of openness and allow for [reproducible builds](https://reproducible-builds.org), allowing third parties to verify that the downloaded binaries match the released source code. As of now, that's impossible thanks to iOS's closed nature. A fully open-source iOS would also be the first step in third-party operating system support on the platform.
+I'd like to see Apple release the source code of its entire OS in order to foster a spirit of openness and enable [reproducible builds](https://reproducible-builds.org). The latter would allow third parties to verify that the downloaded binaries match the released source code. Currently, that's impossible due to iOS's closed nature. Furthermore, a fully open-source iOS would also be the first step in third-party OS support on the platform.
 
 ### Android
 

From 3d687ffdf132e4bf96826f88d4f7d2eb6d909b9e Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:34:36 -0500
Subject: [PATCH 30/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index f932afaf..a0d1d170 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -18,7 +18,7 @@ Both Android and iOS run on the vast majority of our mobile devices, meaning the
 
 ## Source Model
 
-One of the most glaring differences is the source model of each operating system: iOS is *mostly* closed source while Android is *mostly* open source, I'll get to what I mean by that in a bit.
+One of the most glaring differences is the source model of each operating system: iOS is *mostly* closed source while Android is *mostly* open source. Continue reading to learn the implications of this difference.
 
 ### iOS
 

From 4bdcdc15ea82a2c0c6c61d34534ca575e21d653a Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:35:08 -0500
Subject: [PATCH 31/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index a0d1d170..5b554d7b 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -32,7 +32,7 @@ I'd like to see Apple release the source code of its entire OS in order to foste
 
 The beating heart of Android is the [Android Open Source Project](https://source.android.com) (AOSP). AOSP is essentially a complete, open-source mobile OS on its own. Android was designed from the beginning to be used by lots of different companies for each of their own mobile phone offerings, so the open nature is useful toward that goal.
 
-However, AOSP is only a bare-bones operating system. OEMs are expected to add their own proprietary components to make their own, custom user experience. This is why most Android phones you buy are full of proprietary software like Facebook and other OEM software; companies that sell Android phones mainly use AOSP as a secure base to then run on their phones with proprietary drivers and their own custom Android. While the openness of AOSP is great, the OEMs making the phones ultimately ruin it.
+However, AOSP is only a bare-bones OS. OEMs are expected to add their own proprietary components to make a custom user experience specific to their brand. This is why most Android phones you buy are pre-installed with proprietary software like Facebook and other OEM software. Companies that sell Android phones mainly use AOSP as a secure base to then run on their phones with proprietary drivers and a custom Android OS. While the openness of AOSP is great, the OEMs producing the phones ultimately ruin it.
 
 Because AOSP is open source though, non-OEM third parties such as [GrapheneOS](https://grapheneos.org) have made their own fully open-source Android OS. Unlike stock Android operating systems, GrapheneOS supports [reproducible builds](https://grapheneos.org/build#reproducible-builds).
 

From ba36368fcb57898fe0a50f00fc6140dad4aca425 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:35:47 -0500
Subject: [PATCH 32/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 5b554d7b..5b1aa7e6 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -36,7 +36,7 @@ However, AOSP is only a bare-bones OS. OEMs are expected to add their own propri
 
 Because AOSP is open source though, non-OEM third parties such as [GrapheneOS](https://grapheneos.org) have made their own fully open-source Android OS. Unlike stock Android operating systems, GrapheneOS supports [reproducible builds](https://grapheneos.org/build#reproducible-builds).
 
-Many custom AOSP operating systems, while being open source, actually reduce security from AOSP through delayed updates and not supporting important Android security features like [Verified Boot](https://source.android.com/docs/security/features/verifiedboot) (this problem applies to many open source Android operating systems, but not GrapheneOS as they explicitly aim to never downgrade security from AOSP).
+Many open-source, custom AOSP-based operating systems actually reduce security from AOSP through delayed updates and lack of support for important Android security features like [Verified Boot](https://www.privacyguides.org/en/os/android-overview/#verified-boot). GrapheneOS is an exception as they explicitly aim to [never downgrade security from AOSP](https://grapheneos.org/features#:~:text=It%20starts%20from%20the%20strong%20baseline%20of%20the%20Android%20Open%20Source%20Project%20(AOSP)%20and%20takes%20great%20care%20to%20avoid%20increasing%20attack%20surface%20or%20hurting%20the%20strong%20security%20model.).
 
 One problem custom Android operating systems face is the inherent issue of being [downstream](https://en.wikipedia.org/wiki/Downstream_(software_development)) of AOSP, which means third-party operating systems must wait for the upstream project to ship patches and updates. In this case, AOSP-based operating systems are [at the whim of Google](https://x.com/grapheneos/status/1964561043906048183) for timely security patches and updates, which is not ideal.
 

From 5ffbd8d85cf81933dc156b8bdf44015797716b4a Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:37:31 -0500
Subject: [PATCH 33/68] link to android documentation for verified boot

---
 blog/posts/ios-vs-android.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 5b1aa7e6..4db969f2 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -36,7 +36,7 @@ However, AOSP is only a bare-bones OS. OEMs are expected to add their own propri
 
 Because AOSP is open source though, non-OEM third parties such as [GrapheneOS](https://grapheneos.org) have made their own fully open-source Android OS. Unlike stock Android operating systems, GrapheneOS supports [reproducible builds](https://grapheneos.org/build#reproducible-builds).
 
-Many open-source, custom AOSP-based operating systems actually reduce security from AOSP through delayed updates and lack of support for important Android security features like [Verified Boot](https://www.privacyguides.org/en/os/android-overview/#verified-boot). GrapheneOS is an exception as they explicitly aim to [never downgrade security from AOSP](https://grapheneos.org/features#:~:text=It%20starts%20from%20the%20strong%20baseline%20of%20the%20Android%20Open%20Source%20Project%20(AOSP)%20and%20takes%20great%20care%20to%20avoid%20increasing%20attack%20surface%20or%20hurting%20the%20strong%20security%20model.).
+Many open-source, custom AOSP-based operating systems actually reduce security from AOSP through delayed updates and lack of support for important Android security features like [Verified Boot](https://source.android.com/docs/security/features/verifiedboot). GrapheneOS is an exception as they explicitly aim to [never downgrade security from AOSP](https://grapheneos.org/features#:~:text=It%20starts%20from%20the%20strong%20baseline%20of%20the%20Android%20Open%20Source%20Project%20(AOSP)%20and%20takes%20great%20care%20to%20avoid%20increasing%20attack%20surface%20or%20hurting%20the%20strong%20security%20model.).
 
 One problem custom Android operating systems face is the inherent issue of being [downstream](https://en.wikipedia.org/wiki/Downstream_(software_development)) of AOSP, which means third-party operating systems must wait for the upstream project to ship patches and updates. In this case, AOSP-based operating systems are [at the whim of Google](https://x.com/grapheneos/status/1964561043906048183) for timely security patches and updates, which is not ideal.
 
@@ -224,4 +224,7 @@ While Safari does offer good [privacy features](https://webkit.org/blog/15697/pr
 
 Locking users out of other browsers stifles competition and user freedom, not to mention potentially [putting users at risk](https://predictors.fail/#:~:text=As%20pointed%20out%20by%20iLeakage%2C%20Safari%20lacks%20Site%20Isolation%2C%20a%20measure%20used%20to%20enforce%20that%20two%20different%20webpages%20not%20from%20the%20same%20domain%20can%20never%20be%20handled%20by%20the%20same%20process.) by locking them out of using browsers with faster updates and more advanced [security features](https://www.chromium.org/Home/chromium-security/site-isolation/).
 
-Apple should open up their ecosystem to allow for alternate browser engines globally instead of just in the EU.
\ No newline at end of file
+Apple should open up their ecosystem to allow for alternate browser engines globally instead of just in the EU.
+
+## Optional App Hardening
+

From 3242e37f811544987d570487926ca33a475e3de7 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:38:27 -0500
Subject: [PATCH 34/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 4db969f2..16d55541 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -42,7 +42,7 @@ One problem custom Android operating systems face is the inherent issue of being
 
 ## Hardware
 
-Hardware is vital to security. Modern smartphones are complicated, with lots of different processors and components, all running their own firmware and with their own potential security vulnerabilities. It's important to lock down these components as much as possible.
+Hardware is vital to security. Modern smartphones pose a challenge with lots of processors and components, each with their own firmware and potential security vulnerabilities. It's important to lock down these components as much as possible.
 
 ### iOS
 

From 20ecbd31a1b32b0de3fccf535252565c2c385561 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:39:07 -0500
Subject: [PATCH 35/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 16d55541..b77b16f3 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -48,7 +48,7 @@ Hardware is vital to security. Modern smartphones pose a challenge with lots of
 
 Apple makes their own SoC on their platforms, which affords them a lot of control over how it works. You can read about how they integrate their hardware tightly on their [Apple Platform Security](https://support.apple.com/guide/security/hardware-security-overview-secf020d1074/web) page.
 
-Apple has started to replace other components as well, with their newest phones boasting their N1 wireless chip that handles Wi-Fi, Bluetooth, and Thread connectivity as well as their in-house cellular modem. Apple has a lot of control over the components in their phones which avoids supply-chain issues that other OEMs run into, with each third-party component relying on a third party to [patch security vulnerabilities](https://binarly.io/blog/the-firmware-supply-chain-security-is-broken-can-we-fix-it) and fix bugs in their firmware.
+Apple has started to replace other components as well, with their newest phones boasting their N1 wireless chip that handles Wi-Fi, Bluetooth, and Thread connectivity, as well as their in-house cellular modem. Apple has a lot of control over the components in their phones, which avoids supply chain issues that other OEMs encounter, where each component relies on a third party to [patch security vulnerabilities](https://binarly.io/blog/the-firmware-supply-chain-security-is-broken-can-we-fix-it) and fix bugs in their firmware.
 
 ![Graphic showing the supply chain of various OEMs, and Apple bypassing the whole supply chain because they use their own firmware and hardware](../assets/images/ios-vs-android/binarly-graphic.png)
 

From b729f43ab30cf08916589137d4a0225bb38e303b Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:39:27 -0500
Subject: [PATCH 36/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index b77b16f3..6cb5f4cc 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -54,7 +54,7 @@ Apple has started to replace other components as well, with their newest phones
 
 <small aria-hidden="true">Photo: [Binarly](https://binarly.io/blog/the-firmware-supply-chain-security-is-broken-can-we-fix-it)</small>
 
-Apple can deal with vulnerabilities themselves when they're reported instead of waiting for a third party to fix it. According to their [docs](https://support.apple.com/guide/security/peripheral-processor-security-seca500d4f2b/1/web/1):
+Apple can patch vulnerabilities themselves when they're reported instead of waiting for a third party to fix them. According to their [docs](https://support.apple.com/guide/security/peripheral-processor-security-seca500d4f2b/1/web/1):
 
 > Whenever possible, Apple works to reduce the number of peripheral processors necessary and to avoid designs that require firmware. But when separate processors with their own firmware are required, efforts are taken to help ensure an attacker can’t persist on that processor.
 

From cedcb1cb6e60bb14a54ce2766a05f9d029ce8872 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:40:32 -0500
Subject: [PATCH 37/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 6cb5f4cc..437c7995 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -62,7 +62,7 @@ They take care to reduce attack surface by disabling debug interfaces and signin
 
 Apple also supports all the important hardware security features you'd want, like a [Secure Element](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) for secure cryptography and secret storage, secure [biometric hardware](https://support.apple.com/guide/security/biometric-security-sec067eb0c9e/1/web/1) including 3D face scans for Face ID, hardware-backed [indicator lights](https://theapplewiki.com/wiki/Secure_Indicator_Light) for camera and microphone, [hardware kill switches](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/1/web/1) for the microphone on iPads, and [MTE](https://security.apple.com/blog/memory-integrity-enforcement) for their latest iPhones.
 
-Processors that deal with networking are isolated via an [IOMMU](https://support.apple.com/guide/security/security-features-connecting-wireless-sec8a67fa93d/1/web/1#sec7e0184776) so that they can't access each other's memory.
+Processors that handle networking are isolated via an [IOMMU](https://support.apple.com/guide/security/security-features-connecting-wireless-sec8a67fa93d/1/web/1#sec7e0184776) so that they can't access each other's memory.
 
 Overall, Apple does an excellent job with hardware security. Most Android OEMs could stand to learn from them.
 

From 82737a6ed11901fb673e5ea269768fb70573d133 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:41:04 -0500
Subject: [PATCH 38/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 437c7995..e0fdd412 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -92,7 +92,7 @@ In the EU, Apple was forced to allow [third-party app stores](https://developer.
 
 Android takes the opposite approach and lets you simply download and run apps from the internet. This gives you much more freedom as a user but could potentially open you up to more malicious apps, for example, apps that abuse [accessibility permissions](https://blog.pradeo.com/accessibility-services-mobile-analysis-malware) to gain deep access to your device.
 
-The Google Play Store sets a strict [SDK level requirement](https://developer.android.com/google/play/requirements/target-sdk), but apps downloaded outside the Google Play Store have much more leniency. Sideloaded apps can target very old SDK levels, which means they won't have the same security restrictions as apps targeting newer SDK's. The biggest restriction that seems to exist in the OS preventing running older SDK's is if an app targets an SDK at or below Android 5.1 (!?) you'll get a warning message. For reference, Android 5 came out in 2014.
+The Google Play Store sets a strict [SDK level requirement](https://developer.android.com/google/play/requirements/target-sdk), but apps downloaded outside the Google Play Store have much more leniency. Sideloaded apps can target very old SDK levels, which means they won't have the same security restrictions as apps targeting newer SDK's. The closest thing to a guardrail against running apps with older SDKs is a warning notification from the OS about an app targeting an SDK at or below Android 5.1 (!?). For reference, Android 5 came out in 2014.
 
 I think Android could stand to enforce a higher SDK level and simply refuse to run apps that target lower than say a few versions ago. There's no reason to support apps that think they're on Android 5.
 

From da03a7191a5f4dfd0acc9f0c6d96ae67cfdde21c Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:41:36 -0500
Subject: [PATCH 39/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index e0fdd412..2c300fd9 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -94,9 +94,7 @@ Android takes the opposite approach and lets you simply download and run apps fr
 
 The Google Play Store sets a strict [SDK level requirement](https://developer.android.com/google/play/requirements/target-sdk), but apps downloaded outside the Google Play Store have much more leniency. Sideloaded apps can target very old SDK levels, which means they won't have the same security restrictions as apps targeting newer SDK's. The closest thing to a guardrail against running apps with older SDKs is a warning notification from the OS about an app targeting an SDK at or below Android 5.1 (!?). For reference, Android 5 came out in 2014.
 
-I think Android could stand to enforce a higher SDK level and simply refuse to run apps that target lower than say a few versions ago. There's no reason to support apps that think they're on Android 5.
-
-GrapheneOS raises the minimum SDK from AOSP.
+I think Android could stand to enforce a higher SDK level and simply refuse to run apps that target lower than say a few versions ago. There's no reason to support apps that think they're on Android 5. GrapheneOS, in line with its firm security posture, raises the minimum SDK from AOSP.
 
 Because of Android's support for third-party app stores, it's possible to use an app store with superior security to the Google Play Store. [Accrescent](https://accrescent.app) is just such an example.
 

From d2be31d6e1511be90adc0dd513af618a7aadfe5e Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:42:00 -0500
Subject: [PATCH 40/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 2c300fd9..e26a20ec 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -98,7 +98,7 @@ I think Android could stand to enforce a higher SDK level and simply refuse to r
 
 Because of Android's support for third-party app stores, it's possible to use an app store with superior security to the Google Play Store. [Accrescent](https://accrescent.app) is just such an example.
 
-Accrescent allows for developers to control their own signing keys, and doesn't require an account, among other improvements. This is an improvement over the Google Play Store where Google controls the signing keys, and you need a Google account to use it.
+Accrescent, among other features, allows for developers to control their own signing keys and doesn't require an account. This is an improvement over the Google Play Store where Google controls the signing keys and you need a Google account to download apps from it.
 
 ## Alternate OS Support
 

From 96bc36d11966b97abb917eed08711b0e8ef47123 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:43:43 -0500
Subject: [PATCH 41/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index e26a20ec..10d1b71b 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -106,7 +106,7 @@ Support for installing alternate operating systems isn't just important for user
 
 ### iOS
 
-In order to install any apps or use many features on iOS, you need an [Apple Account](https://account.apple.com). Apple Accounts ask for your real name and require a phone number to use, on top of tying your app and other purchases to an account. While iOS is known to be privacy-friendly, Apple's [privacy policy](https://www.apple.com/legal/privacy/en-ww/) leaves a lot to be desired.
+In order to install any apps or use many features on iOS, you need an [Apple Account](https://account.apple.com). Apple Accounts ask for your real name and require a phone number during account creation, on top of tying your app and other purchases to an account. While iOS is known to be privacy-friendly, Apple's [privacy policy](https://www.apple.com/legal/privacy/en-ww) leaves a lot to be desired.
 
 iOS doesn't allow you to unlock the bootloader to install another operating system. While [jailbreaking](https://en.wikipedia.org/wiki/IOS_jailbreaking) is possible, it requires exploiting your device and ultimately your security will be much worse.
 

From d71dfc6e6d9fffc8f9fa550c5f3709f9de5372fc Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:44:11 -0500
Subject: [PATCH 42/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 10d1b71b..d6e73caa 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -108,7 +108,7 @@ Support for installing alternate operating systems isn't just important for user
 
 In order to install any apps or use many features on iOS, you need an [Apple Account](https://account.apple.com). Apple Accounts ask for your real name and require a phone number during account creation, on top of tying your app and other purchases to an account. While iOS is known to be privacy-friendly, Apple's [privacy policy](https://www.apple.com/legal/privacy/en-ww) leaves a lot to be desired.
 
-iOS doesn't allow you to unlock the bootloader to install another operating system. While [jailbreaking](https://en.wikipedia.org/wiki/IOS_jailbreaking) is possible, it requires exploiting your device and ultimately your security will be much worse.
+iOS doesn't allow you to unlock the bootloader to install another OS. While [jailbreaking](https://en.wikipedia.org/wiki/IOS_jailbreaking) is possible, it requires exploiting your device and ultimately undermining your device's security.
 
 iOS should allow for fully unlocking and relocking the bootloader for alternate operating systems so that a version of iOS without any user data being sent to Apple can be installed.
 

From 3880203a68d85cb44cee7db843cdf477b1234ad6 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:44:53 -0500
Subject: [PATCH 43/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index d6e73caa..4f0618a6 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -130,7 +130,7 @@ The open nature of Android is ruined a bit by most of the OEMs, like [Samsung](h
 
 GrapheneOS is probably the best example of what an alternate OS can achieve. They've made [significant security improvements](https://grapheneos.org/features) over the default Pixel OS and AOSP.
 
-GrapheneOS utilizes hardware features like MTE, which is locked behind [Advanced Protection](https://support.google.com/accounts/answer/9764949?hl=en) normally, by default and with significantly [more coverage](https://x.com/GrapheneOS/status/1965810573066768865#m).
+For example, whereas MTE is locked behind [Advanced Protection](https://support.google.com/accounts/answer/9764949?hl=en) on the stock Pixel OS, GrapheneOS utilizes the hardware feature by default and with significantly [more coverage](https://x.com/GrapheneOS/status/1965810573066768865#m).
 
 They also disable USB at the [hardware level](https://grapheneos.org/features#usb-c-port-and-pogo-pins-control). This is a demonstrable security improvement, as forensics companies like [Cellebrite](https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation) have leaked documentation showing they're not able to get into GrapheneOS devices above a 2022 patch level.
 

From ad24f5e9aa505f67d196c4f68c1670c0f17d3387 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:45:20 -0500
Subject: [PATCH 44/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 4f0618a6..ca60bc2d 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -132,7 +132,7 @@ GrapheneOS is probably the best example of what an alternate OS can achieve. The
 
 For example, whereas MTE is locked behind [Advanced Protection](https://support.google.com/accounts/answer/9764949?hl=en) on the stock Pixel OS, GrapheneOS utilizes the hardware feature by default and with significantly [more coverage](https://x.com/GrapheneOS/status/1965810573066768865#m).
 
-They also disable USB at the [hardware level](https://grapheneos.org/features#usb-c-port-and-pogo-pins-control). This is a demonstrable security improvement, as forensics companies like [Cellebrite](https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation) have leaked documentation showing they're not able to get into GrapheneOS devices above a 2022 patch level.
+GrapheneOS also disables USB at the [hardware level](https://grapheneos.org/features#usb-c-port-and-pogo-pins-control). This is a demonstrable security improvement, as forensics companies like [Cellebrite](https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation) have leaked documentation showing they're not able to get into GrapheneOS devices above a 2022 patch level.
 
 The ability to unlock the bootloader on Android devices is a huge boon for security research as well.
 

From 9fe5005ad8706547f80ff8be830ede0c573aa4e7 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:45:59 -0500
Subject: [PATCH 45/68] wording

Co-authored-by: redoomed1 <redoomed1@privacyguides.org>
Signed-off-by: fria <138676274+friadev@users.noreply.github.com>
---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index ca60bc2d..8406bf9c 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -146,7 +146,7 @@ iOS has historically been ahead of AOSP in terms of the permissions it offers.
 
 iOS's [paste permission](https://developer.apple.com/documentation/uikit/uipasteboard) prevents apps from nefariously reading data from your clipboard without your permission, something AOSP lacks still.
 
-Since iOS 13, apps need to go through the [system file picker](https://developer.apple.com/documentation/uikit/providing-access-to-directories) and are only granted access to the specific files the user allows via a security-scoped URL, they don't gain access to the full filesystem like apps can on [Android](https://developer.android.com/training/data-storage/manage-all-files#:~:text=Android%20provides%20a%20special%20app%20access%20called%20all%2Dfiles%20access%20for%20these%20situations.).
+Since iOS 13, when apps request file access, apps need to go through the [system file picker](https://developer.apple.com/documentation/uikit/providing-access-to-directories) and are only granted access to the specific files the user allows via a security-scoped URL. They don't gain access to the full filesystem like apps can on [Android](https://developer.android.com/training/data-storage/manage-all-files#:~:text=Android%20provides%20a%20special%20app%20access%20called%20all%2Dfiles%20access%20for%20these%20situations.).
 
 iOS added the [Local Network](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) permission in iOS 14, preventing apps from accessing other devices on your local network such as other phones or computers, maybe even network drives with sensitive data on them. Android later [added this permission](https://developer.android.com/privacy-and-security/local-network-permission) in Android 16, albeit currently as opt-in for developers.
 

From 4a10a726bdc03a2b3887e176b6b2b5fcf15b2778 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 02:46:41 -0500
Subject: [PATCH 46/68] wording

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 8406bf9c..cbef7017 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -146,7 +146,7 @@ iOS has historically been ahead of AOSP in terms of the permissions it offers.
 
 iOS's [paste permission](https://developer.apple.com/documentation/uikit/uipasteboard) prevents apps from nefariously reading data from your clipboard without your permission, something AOSP lacks still.
 
-Since iOS 13, when apps request file access, apps need to go through the [system file picker](https://developer.apple.com/documentation/uikit/providing-access-to-directories) and are only granted access to the specific files the user allows via a security-scoped URL. They don't gain access to the full filesystem like apps can on [Android](https://developer.android.com/training/data-storage/manage-all-files#:~:text=Android%20provides%20a%20special%20app%20access%20called%20all%2Dfiles%20access%20for%20these%20situations.).
+Since iOS 13, when apps request file access, they need to go through the [system file picker](https://developer.apple.com/documentation/uikit/providing-access-to-directories) and are only granted access to the specific files the user allows via a security-scoped URL. They don't gain access to the full filesystem like apps can on [Android](https://developer.android.com/training/data-storage/manage-all-files#:~:text=Android%20provides%20a%20special%20app%20access%20called%20all%2Dfiles%20access%20for%20these%20situations.).
 
 iOS added the [Local Network](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) permission in iOS 14, preventing apps from accessing other devices on your local network such as other phones or computers, maybe even network drives with sensitive data on them. Android later [added this permission](https://developer.android.com/privacy-and-security/local-network-permission) in Android 16, albeit currently as opt-in for developers.
 

From 6397966a1dd2605ee685bb489864569e7eeb7380 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Wed, 5 Nov 2025 08:44:57 -0600
Subject: [PATCH 47/68] add ios kernel

---
 blog/posts/ios-vs-android.md | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index cbef7017..c5830bc3 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -40,6 +40,34 @@ Many open-source, custom AOSP-based operating systems actually reduce security f
 
 One problem custom Android operating systems face is the inherent issue of being [downstream](https://en.wikipedia.org/wiki/Downstream_(software_development)) of AOSP, which means third-party operating systems must wait for the upstream project to ship patches and updates. In this case, AOSP-based operating systems are [at the whim of Google](https://x.com/grapheneos/status/1964561043906048183) for timely security patches and updates, which is not ideal.
 
+## Kernel
+
+The kernel is the low-level code that controls just about everything that happens in an operating system. As you can imagine, a kernel exploit could give an attacker highly privileged access to your system, so the kernel should be as locked down and as minimal as possible, with it being written in a memory-safe language like Rust. Unfortunately, operating systems until now have mostly resorted to a monolithic kernel design, which puts all duties of the operating system like memory management, device drivers, etc are in the kernel proper. This allows for more performance and less complexity but much more attack surface.
+
+In contrast, a microkernel design puts as much as possible outside the kernel, which reduces the possible attack surface but increases the complexity and can have a performance hit.
+
+### iOS
+
+iOS uses their own open source XNU kernel for their operating systems. It's an interesting design as Apple originally took the [Mach](https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/KernelProgramming/Mach/Mach.html) microkernel and combined it with code from the monolithic [FreeBSD](https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/KernelProgramming/BSD/BSD.html#//apple_ref/doc/uid/TP30000905-CH214-TPXREF101) kernel to create the hybrid [XNU](https://github.com/apple-oss-distributions/xnu) kernel.
+
+This leaves XNU in an interesting place where it's doesn't have the full attack surface of a monolithic kernel nor the full security of a microkernel, since 
+
+>in OS X, Mach is linked with other kernel components into a single kernel address space. This is primarily for performance; it is much faster to make a direct call between linked components than it is to send messages or do remote procedure calls (RPC) between separate tasks. This modular structure results in a more robust and extensible system than a monolithic kernel would allow, without the performance penalty of a pure microkernel.
+
+It's a bit frustrating to know that the only reason they didn't go with a full microkernel design seems to be performance; I'd like to think that nowadays computers are fast enough that it wouldn't matter so much. Apple should persue a microkernel design as soon as possible to avoid kernel exploits.
+
+Apple has made good progress in pushing for things like drivers to run in userspace rather than kernelspace through [System Extensions](https://developer.apple.com/documentation/systemextensions), which replace [kernel extensions](https://support.apple.com/guide/security/securely-extending-the-kernel-sec8e454101b/web) that used to run in the kernel. This is a promising development and I think it represents a desire from Apple to move toward a microkernel.
+
+### Exclaves
+
+Apple as seemingly been working on a new feature inside their kernel called "[exclaves](https://www.theregister.com/2025/03/08/kernel_sanders_apple_rearranges_xnu/)" that appear to isolate and protect components of the kernel from the rest of the kernel.
+
+An interesting example of how this is being used is to [secure](https://theapplewiki.com/wiki/Secure_Indicator_Light) the camera and microphone indicator lights so that a compromise of the kernel won't mean a compromise of the indicator lights.
+
+There are references to a new "Secure Kernel" with a version string for "cL4" which may be a reference to the secure [seL4](https://sel4.systems) microkernel, possibly hinting even more at Apple's long-term ambitions.
+
+This is great news, I hope we hear more about exclaves in the future, especially via an official announcement from Apple and not from digging through code.
+
 ## Hardware
 
 Hardware is vital to security. Modern smartphones pose a challenge with lots of processors and components, each with their own firmware and potential security vulnerabilities. It's important to lock down these components as much as possible.

From 25f8665695c236d37b96bf0c5a1443c7b81402fc Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Wed, 5 Nov 2025 09:02:54 -0600
Subject: [PATCH 48/68] add memory safety

---
 blog/posts/ios-vs-android.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index c5830bc3..11dbc105 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -68,6 +68,16 @@ There are references to a new "Secure Kernel" with a version string for "cL4" wh
 
 This is great news, I hope we hear more about exclaves in the future, especially via an official announcement from Apple and not from digging through code.
 
+#### Memory Safety
+
+Unfortunately, the XNU kernel is still mostly written in C. This is a problem for any piece of software but *especially* so for the kernel. I really hope Apple makes an effort to start replacing the internals with a memory-safe language.
+
+[Embedded Swift](https://docs.swift.org/embedded/documentation/embedded/introduction) is a low level programming language based on [Swift](https://www.swift.org) that aims to preserve the memory safety while being more suitable for low-level programs like embedded controllers or system kernels. While it's still experimental, I'll be watching. Apple has switch some of their servers to Swift to massive benefit and they've been switching more of their [iOS apps](https://blog.timac.org/2024/1208-state-of-swift-and-swiftui-ios18/) to Swift, so I believe they will eventually work on switching the rest of their code to Swift in due time.
+
+### Android
+
+Android uses the Linux kernel, a monolithic kernel that's a favorite of sysadmins and open source enthusiasts alike. Unfortunately, the monolithic nature of Linux makes it a [massive attack surface](https://xcancel.com/GrapheneOS/status/1952583510059057188#m) for Android. 
+
 ## Hardware
 
 Hardware is vital to security. Modern smartphones pose a challenge with lots of processors and components, each with their own firmware and potential security vulnerabilities. It's important to lock down these components as much as possible.

From 8a481d322da7e970fdd6eb4dad88bcecf56a53a6 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Wed, 5 Nov 2025 09:16:29 -0600
Subject: [PATCH 49/68] add memory safety for linux

---
 blog/posts/ios-vs-android.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 11dbc105..cd6d7dfc 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -76,7 +76,15 @@ Unfortunately, the XNU kernel is still mostly written in C. This is a problem fo
 
 ### Android
 
-Android uses the Linux kernel, a monolithic kernel that's a favorite of sysadmins and open source enthusiasts alike. Unfortunately, the monolithic nature of Linux makes it a [massive attack surface](https://xcancel.com/GrapheneOS/status/1952583510059057188#m) for Android. 
+Android uses the Linux kernel, a monolithic kernel that's a favorite of sysadmins and open source enthusiasts alike. Unfortunately, the monolithic nature of Linux makes it a [massive attack surface](https://xcancel.com/GrapheneOS/status/1923966381965394221#m) for Android.
+
+GrapheneOS even considers the Linux kernel to be their [main weakness](https://xcancel.com/GrapheneOS/status/1828148094661198105#m) at the moment, and have expressed a desire to switch to a microkernel at some point in the future.
+
+### Memory Safety
+
+The Linux kernel is mainly written in C, a memory-unsafe language.
+
+The [Rust for Linux](https://rust-for-linux.com) has successfully added support for Rust in Linux, and they're looking to increase the amount of memory safe code, so definitely watch out for that.
 
 ## Hardware
 

From da572b2a624f2983b6667fb58b1e0f8b286364de Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Wed, 5 Nov 2025 09:17:43 -0600
Subject: [PATCH 50/68] replace facebook with samsung notes

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index cd6d7dfc..d27962e5 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -32,7 +32,7 @@ I'd like to see Apple release the source code of its entire OS in order to foste
 
 The beating heart of Android is the [Android Open Source Project](https://source.android.com) (AOSP). AOSP is essentially a complete, open-source mobile OS on its own. Android was designed from the beginning to be used by lots of different companies for each of their own mobile phone offerings, so the open nature is useful toward that goal.
 
-However, AOSP is only a bare-bones OS. OEMs are expected to add their own proprietary components to make a custom user experience specific to their brand. This is why most Android phones you buy are pre-installed with proprietary software like Facebook and other OEM software. Companies that sell Android phones mainly use AOSP as a secure base to then run on their phones with proprietary drivers and a custom Android OS. While the openness of AOSP is great, the OEMs producing the phones ultimately ruin it.
+However, AOSP is only a bare-bones OS. OEMs are expected to add their own proprietary components to make a custom user experience specific to their brand. This is why most Android phones you buy are pre-installed with proprietary software like [Samsung Notes](https://www.samsung.com/ae/apps/samsung-notes/) and other OEM software. Companies that sell Android phones mainly use AOSP as a secure base to then run on their phones with proprietary drivers and a custom Android OS. While the openness of AOSP is great, the OEMs producing the phones ultimately ruin it.
 
 Because AOSP is open source though, non-OEM third parties such as [GrapheneOS](https://grapheneos.org) have made their own fully open-source Android OS. Unlike stock Android operating systems, GrapheneOS supports [reproducible builds](https://grapheneos.org/build#reproducible-builds).
 

From e0f177b35383bae1f5e97b529a5e8d23ee92fba4 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 7 Nov 2025 08:10:37 -0600
Subject: [PATCH 51/68] fix typo

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index d27962e5..fe008508 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -84,7 +84,7 @@ GrapheneOS even considers the Linux kernel to be their [main weakness](https://x
 
 The Linux kernel is mainly written in C, a memory-unsafe language.
 
-The [Rust for Linux](https://rust-for-linux.com) has successfully added support for Rust in Linux, and they're looking to increase the amount of memory safe code, so definitely watch out for that.
+The [Rust for Linux](https://rust-for-linux.com) project has successfully added support for Rust in Linux, and they're looking to increase the amount of memory safe code, so definitely watch out for that.
 
 ## Hardware
 

From d78aa38cc145a43d8024060b1eb9c33132ec16a7 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 7 Nov 2025 08:13:03 -0600
Subject: [PATCH 52/68] add swift on server link

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index fe008508..4f3d74d4 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -72,7 +72,7 @@ This is great news, I hope we hear more about exclaves in the future, especially
 
 Unfortunately, the XNU kernel is still mostly written in C. This is a problem for any piece of software but *especially* so for the kernel. I really hope Apple makes an effort to start replacing the internals with a memory-safe language.
 
-[Embedded Swift](https://docs.swift.org/embedded/documentation/embedded/introduction) is a low level programming language based on [Swift](https://www.swift.org) that aims to preserve the memory safety while being more suitable for low-level programs like embedded controllers or system kernels. While it's still experimental, I'll be watching. Apple has switch some of their servers to Swift to massive benefit and they've been switching more of their [iOS apps](https://blog.timac.org/2024/1208-state-of-swift-and-swiftui-ios18/) to Swift, so I believe they will eventually work on switching the rest of their code to Swift in due time.
+[Embedded Swift](https://docs.swift.org/embedded/documentation/embedded/introduction) is a low level programming language based on [Swift](https://www.swift.org) that aims to preserve the memory safety of Swift while being more suitable for low-level programs like embedded controllers or system kernels. While it's still experimental, I'll be watching. Apple has [switched](https://www.swift.org/blog/swift-at-apple-migrating-the-password-monitoring-service-from-java/) some of their servers to Swift to massive benefit and they've been switching more of their [iOS apps](https://blog.timac.org/2024/1208-state-of-swift-and-swiftui-ios18/) to Swift, so I believe they will eventually work on switching the rest of their code to Swift in due time.
 
 ### Android
 

From 948a7427a849d2e651a96a1c75587d3b9c381ce3 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 7 Nov 2025 08:17:31 -0600
Subject: [PATCH 53/68] remove unnecessary line

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 4f3d74d4..0613d364 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -18,7 +18,7 @@ Both Android and iOS run on the vast majority of our mobile devices, meaning the
 
 ## Source Model
 
-One of the most glaring differences is the source model of each operating system: iOS is *mostly* closed source while Android is *mostly* open source. Continue reading to learn the implications of this difference.
+One of the most glaring differences is the source model of each operating system: iOS is *mostly* closed source while Android is *mostly* open source.
 
 ### iOS
 

From 78f32cf3a15140d5568157babb9ef9e8aaf54ef6 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 7 Nov 2025 08:43:11 -0600
Subject: [PATCH 54/68] add android release cycle notes

---
 blog/posts/ios-vs-android.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 0613d364..aa246431 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -40,6 +40,8 @@ Many open-source, custom AOSP-based operating systems actually reduce security f
 
 One problem custom Android operating systems face is the inherent issue of being [downstream](https://en.wikipedia.org/wiki/Downstream_(software_development)) of AOSP, which means third-party operating systems must wait for the upstream project to ship patches and updates. In this case, AOSP-based operating systems are [at the whim of Google](https://x.com/grapheneos/status/1964561043906048183) for timely security patches and updates, which is not ideal.
 
+Google doesn't make Android code fully open source for the full development cycle; instead they have an [internal](https://source.android.com/docs/setup/contribute/release-lifecycle) branch that's not accessible to the public which they then release to the public when they deem it's ready.
+
 ## Kernel
 
 The kernel is the low-level code that controls just about everything that happens in an operating system. As you can imagine, a kernel exploit could give an attacker highly privileged access to your system, so the kernel should be as locked down and as minimal as possible, with it being written in a memory-safe language like Rust. Unfortunately, operating systems until now have mostly resorted to a monolithic kernel design, which puts all duties of the operating system like memory management, device drivers, etc are in the kernel proper. This allows for more performance and less complexity but much more attack surface.

From ed92a35baa5d58b9073839344456c4b0f08738b9 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 7 Nov 2025 08:47:31 -0600
Subject: [PATCH 55/68] elaborate on android release cycle

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index aa246431..86dc3ce9 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -40,7 +40,7 @@ Many open-source, custom AOSP-based operating systems actually reduce security f
 
 One problem custom Android operating systems face is the inherent issue of being [downstream](https://en.wikipedia.org/wiki/Downstream_(software_development)) of AOSP, which means third-party operating systems must wait for the upstream project to ship patches and updates. In this case, AOSP-based operating systems are [at the whim of Google](https://x.com/grapheneos/status/1964561043906048183) for timely security patches and updates, which is not ideal.
 
-Google doesn't make Android code fully open source for the full development cycle; instead they have an [internal](https://source.android.com/docs/setup/contribute/release-lifecycle) branch that's not accessible to the public which they then release to the public when they deem it's ready.
+Google doesn't make Android code fully open source for the full development cycle; instead they have an [internal](https://source.android.com/docs/setup/contribute/release-lifecycle) branch that's not accessible to the public which they then release to the public when they deem it's ready, which means that any patches in this internal branch are not accessible to any project that exclusively relies on AOSP code.
 
 ## Kernel
 

From 3652879d8610622e83722e827809540fa8dbec37 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 7 Nov 2025 08:49:21 -0600
Subject: [PATCH 56/68] fix typo

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 86dc3ce9..0233d0e5 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -262,7 +262,7 @@ The browser is a major way users are exposed to malware. Your browser runs untru
 
 ### iOS
 
-On iOS, you're [locked to using WebKit](https://developer.apple.com/app-store/review/guidelines/#:~:text=Apps%20that%20browse%20the%20web%20must%20use%20the%20appropriate%20WebKit%20framework%20and%20WebKit%20JavaScript.). Any other browesr you install is essentially just a reskin of Safari.
+On iOS, you're [locked to using WebKit](https://developer.apple.com/app-store/review/guidelines/#:~:text=Apps%20that%20browse%20the%20web%20must%20use%20the%20appropriate%20WebKit%20framework%20and%20WebKit%20JavaScript.). Any other browser you install is essentially just a reskin of Safari.
 
 Apple did allow [alternate browser engines](https://developer.apple.com/support/alternative-browser-engines/) in the EU, but in other regions you're still locked to using WebKit.
 

From 6dd63b521780fcec924fa279988fcdfb55c4c08d Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 7 Nov 2025 08:52:04 -0600
Subject: [PATCH 57/68] add mention of no alternate browser engines on ios

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 0233d0e5..2beb721c 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -264,7 +264,7 @@ The browser is a major way users are exposed to malware. Your browser runs untru
 
 On iOS, you're [locked to using WebKit](https://developer.apple.com/app-store/review/guidelines/#:~:text=Apps%20that%20browse%20the%20web%20must%20use%20the%20appropriate%20WebKit%20framework%20and%20WebKit%20JavaScript.). Any other browser you install is essentially just a reskin of Safari.
 
-Apple did allow [alternate browser engines](https://developer.apple.com/support/alternative-browser-engines/) in the EU, but in other regions you're still locked to using WebKit.
+Apple did allow [alternate browser engines](https://developer.apple.com/support/alternative-browser-engines/) in the EU, but in other regions you're still locked to using WebKit. However, there have yet to be any [alternate browser engines](https://www.macobserver.com/news/15-months-later-iphone-users-still-cant-choose-a-real-browser/) available that I could find.
 
 While Safari does offer good [privacy features](https://webkit.org/blog/15697/private-browsing-2-0/), it's lacking some important security protections that other browsers have like [site isolation](https://docs.webkit.org/Deep%20Dive/SiteIsolation.html#finding-what-needs-to-be-done), which they are currently working on implementing but it will be some time before it's done.
 

From 1cf5a7adae1c7c5862785cc0eb670917f7c72892 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 7 Nov 2025 09:03:27 -0600
Subject: [PATCH 58/68] add app fingerprinting

---
 blog/posts/ios-vs-android.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 2beb721c..6246a71b 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -272,5 +272,13 @@ Locking users out of other browsers stifles competition and user freedom, not to
 
 Apple should open up their ecosystem to allow for alternate browser engines globally instead of just in the EU.
 
+## App Fingerprinting
+
+Just like in a browser, it's possible for an to fingerprint your device and identify you as the same person. It's not as much of a concern usually as on browsers since apps tend to keep persistent data while they're installed anyway, but it's something to keep in mind.
+
+### iOS
+
+
+
 ## Optional App Hardening
 

From a935afe1a3bca16249ab6303c6af1dd7a787d174 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 7 Nov 2025 09:39:29 -0600
Subject: [PATCH 59/68] add info about ios fingerprinting

---
 blog/posts/ios-vs-android.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 6246a71b..2827ddb3 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -278,7 +278,11 @@ Just like in a browser, it's possible for an to fingerprint your device and iden
 
 ### iOS
 
+It's difficult to know all the exact methods used for fingerpinting as fingerprinting services like [fingerprint.com](https://fingerprint.com) are tight-lipped on a lot of it. They don't want anyone knowing how they do it so operating systems can patch those vectors. However, we can use their apps and test how effective they are, and look at what they make visible to us.
 
+Fingerprint offers an iOS [demo app](https://apps.apple.com/en/app/fingerprint-pro/id1644105278) so you can see how well it works.
+
+Fingerprinting may not be all that necessary however since Apple's [IDFV](https://developer.apple.com/documentation/uikit/uidevice/identifierforvendor) by design allows apps by the same vendor to identify the same device. It changes when all apps by that vendor are deleted but in my testing, I got the same identifier in their demo app even after deleting and reinstalling the apps. Fingerprint claims that the idnetifier will be the same after a device restart, after deleting and reinstalling the app, after installing a provisioning profile, after jailbreaking, after lockdown mode is enabled, and after reseting the device settings to their default values. The only case when it will change is after a full factory reset.
 
 ## Optional App Hardening
 

From e8cc8d87532d72b3e4fa6990ea03502f50019cb7 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Fri, 7 Nov 2025 09:45:38 -0600
Subject: [PATCH 60/68] add more ios fingeprinting info

---
 blog/posts/ios-vs-android.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 2827ddb3..b604d529 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -284,5 +284,11 @@ Fingerprint offers an iOS [demo app](https://apps.apple.com/en/app/fingerprint-p
 
 Fingerprinting may not be all that necessary however since Apple's [IDFV](https://developer.apple.com/documentation/uikit/uidevice/identifierforvendor) by design allows apps by the same vendor to identify the same device. It changes when all apps by that vendor are deleted but in my testing, I got the same identifier in their demo app even after deleting and reinstalling the apps. Fingerprint claims that the idnetifier will be the same after a device restart, after deleting and reinstalling the app, after installing a provisioning profile, after jailbreaking, after lockdown mode is enabled, and after reseting the device settings to their default values. The only case when it will change is after a full factory reset.
 
+It will also try to detect if your device is jailbroken, or has been factory reset.
+
+I think it's clear that Apple draws the line at the same vendor having the same device ID when their apps are installed, but apps are clearly still able to identify you even then.
+
+Apple's [IDFA](https://developer.apple.com/documentation/adsupport/asidentifiermanager/advertisingidentifier) is meant to provide this type of identifiers across vendors over time on the same device only optionally through the [App Tracking Transparency](https://developer.apple.com/documentation/AppTrackingTransparency) framework. Clearly this level of fingerprinting is a violation of Apple's intentions for the identifiers on iOS and I hope they can address whatever is being used as a fingerprinting vector here.
+
 ## Optional App Hardening
 

From 88e94a3b20d0492dab7fa69ea21ce2b841ae8ddc Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 9 Nov 2025 07:19:19 -0600
Subject: [PATCH 61/68] android app fingerprinting

---
 blog/posts/ios-vs-android.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index b604d529..d7f0bd2b 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -290,5 +290,13 @@ I think it's clear that Apple draws the line at the same vendor having the same
 
 Apple's [IDFA](https://developer.apple.com/documentation/adsupport/asidentifiermanager/advertisingidentifier) is meant to provide this type of identifiers across vendors over time on the same device only optionally through the [App Tracking Transparency](https://developer.apple.com/documentation/AppTrackingTransparency) framework. Clearly this level of fingerprinting is a violation of Apple's intentions for the identifiers on iOS and I hope they can address whatever is being used as a fingerprinting vector here.
 
+### Android
+
+Android app fingerprinting is a well-known problem, with multiple possible vectors. Apps are able to see all other installed apps and the date and time they were updated, for example. A GrapheneOS [forum discussion](https://discuss.grapheneos.org/d/17118-identifiers-across-private-space-and-profiles/4) lays out a few ways app fingerprinting can work, even across profiles.
+
+FingerprintJS supports [Android devices](https://dev.fingerprint.com/docs/native-android-integration) and claims it can identify the same device after it restarts, after app data/cache is cleared, after the app is deleted and reinstalled, after a factory reset, even if the app is installed in different profiles or user accounts. This is particularly upsetting since many people use Android profiles to separate out their activities.
+
+I hope Google will see app fingerprinting as a real problem and take steps to mitigate it, especially between factory resets and profiles. I feel that those are the most important boundaries to uphold: a factory reset should be a clean slate, and a separate profile should be almost like a separate phone.
+
 ## Optional App Hardening
 

From 90d5a01f52a916c1be4708d834fba9e0d7625bad Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 9 Nov 2025 07:36:20 -0600
Subject: [PATCH 62/68] fix typo

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index d7f0bd2b..85881d6d 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -228,7 +228,7 @@ Support for separate user profiles allows for strong separation of activities, s
 
 ### iOS
 
-iOS doesn't allow for separate profiles. This is a major detriment on iOS as Android does support separate profiles, each encrypted with a separate encryption key..
+iOS doesn't allow for separate profiles. This is a major detriment on iOS as Android does support separate profiles, each encrypted with a separate encryption key.
 
 iOS could benefit massively from introducing multiple user profiles. Apple has already implemented the feature on [iPadOS](https://support.apple.com/guide/deployment/shared-ipad-overview-dep9a34c2ba2/web) but requires the iPad to be supervised.
 

From b1d115df368285b85c447bdf35656e4c36ed561d Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 9 Nov 2025 07:44:59 -0600
Subject: [PATCH 63/68] add play protect info

---
 blog/posts/ios-vs-android.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 85881d6d..f32181a8 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -140,6 +140,8 @@ In the EU, Apple was forced to allow [third-party app stores](https://developer.
 
 Android takes the opposite approach and lets you simply download and run apps from the internet. This gives you much more freedom as a user but could potentially open you up to more malicious apps, for example, apps that abuse [accessibility permissions](https://blog.pradeo.com/accessibility-services-mobile-analysis-malware) to gain deep access to your device.
 
+Google [Play Protect](https://developers.google.com/android/play-protect) is a built-in anti-malware in many Android devices that's meant to protect you against malicious apps, so it's not like you're completely defenseless. In my opinion, though, anti-malware isn't the correct solution. Hardening the sandbox with tighter restrictions and more permissions, such as the user-facing [network permission](https://grapheneos.org/features#network-permission-toggle) in GrapheneOS, is the best approach.
+
 The Google Play Store sets a strict [SDK level requirement](https://developer.android.com/google/play/requirements/target-sdk), but apps downloaded outside the Google Play Store have much more leniency. Sideloaded apps can target very old SDK levels, which means they won't have the same security restrictions as apps targeting newer SDK's. The closest thing to a guardrail against running apps with older SDKs is a warning notification from the OS about an app targeting an SDK at or below Android 5.1 (!?). For reference, Android 5 came out in 2014.
 
 I think Android could stand to enforce a higher SDK level and simply refuse to run apps that target lower than say a few versions ago. There's no reason to support apps that think they're on Android 5. GrapheneOS, in line with its firm security posture, raises the minimum SDK from AOSP.

From 27d862873085336c3a69bad3980b931a9a4aea21 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 9 Nov 2025 07:53:01 -0600
Subject: [PATCH 64/68] add advanced protection info

---
 blog/posts/ios-vs-android.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index f32181a8..21a13752 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -142,6 +142,8 @@ Android takes the opposite approach and lets you simply download and run apps fr
 
 Google [Play Protect](https://developers.google.com/android/play-protect) is a built-in anti-malware in many Android devices that's meant to protect you against malicious apps, so it's not like you're completely defenseless. In my opinion, though, anti-malware isn't the correct solution. Hardening the sandbox with tighter restrictions and more permissions, such as the user-facing [network permission](https://grapheneos.org/features#network-permission-toggle) in GrapheneOS, is the best approach.
 
+Google, in a slightly bizarre twist, locks users to only being able to download apps from the Play Store if they enable [Advanced Protection](https://support.google.com/accounts/answer/9764949?hl=en), so if you want the highest security on a stock Android device, you will have to sacrifice sideloading.
+
 The Google Play Store sets a strict [SDK level requirement](https://developer.android.com/google/play/requirements/target-sdk), but apps downloaded outside the Google Play Store have much more leniency. Sideloaded apps can target very old SDK levels, which means they won't have the same security restrictions as apps targeting newer SDK's. The closest thing to a guardrail against running apps with older SDKs is a warning notification from the OS about an app targeting an SDK at or below Android 5.1 (!?). For reference, Android 5 came out in 2014.
 
 I think Android could stand to enforce a higher SDK level and simply refuse to run apps that target lower than say a few versions ago. There's no reason to support apps that think they're on Android 5. GrapheneOS, in line with its firm security posture, raises the minimum SDK from AOSP.

From e0e0ae1149e1ac8f452bc8dfbb04eda8636b3427 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 9 Nov 2025 08:16:48 -0600
Subject: [PATCH 65/68] add apple's app store whitepaper

---
 blog/posts/ios-vs-android.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 21a13752..be23af0a 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -128,6 +128,8 @@ Android and iOS have very different approaches in terms of downloading and acqui
 
 iOS restricts app downloads to their own App Store. Apple claims this is for security purposes, but it restricts user freedom and makes it possible for Apple to [censor](https://9to5mac.com/2024/09/28/apple-cooperating-with-russia-to-remove-vpn-apps-from-app-store) apps in certain regions.
 
+Apple has a [whitepaper](https://www.apple.com/privacy/docs/Building_a_Trusted_Ecosystem_for_Millions_of_Apps.pdf) explaining why they believe restricting to just the App Store is the best approach to security. Unfortuantely, malicious and fruadulent apps [bypass](https://techcrunch.com/2025/10/09/sora-copycats-flooded-apples-app-store-and-some-still-remain/) Apple's App Store review regularly. Automated and human review can only do so much against an onslaught of malicious apps, so I think that a better approach is to design the system to disallow apps from having access to as much as possible and providing users with highly secure devices to prevent malware as much as possible.
+
 The App Store does enforce certain [security](https://support.apple.com/guide/security/about-app-store-security-secb8f887a15/1/web/1) properties, mainly through the App Review process. This process can't catch everything though, and [malware](https://securelist.com/sparkcat-stealer-in-app-store-and-google-play/115385) still slips through the cracks.
 
 The lack of third-party app store support means that it's not possible to use an app store with better security properties than the Apple App Store. For example, apps in the App Store have Apple's DRM, which makes reproducible builds [impossible](https://github.com/signalapp/Signal-iOS/issues/641#:~:text=So%20while%20truly%20reproducible%20builds%20are%20not%20possible). If one wanted to use an app store without this security regression, they'd be out of luck.

From d6d7dbcdc2b636cf68066d7ea52a6425fbeaaf8a Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 9 Nov 2025 08:19:18 -0600
Subject: [PATCH 66/68] add play store criticism

---
 blog/posts/ios-vs-android.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index be23af0a..56f70004 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -146,6 +146,8 @@ Google [Play Protect](https://developers.google.com/android/play-protect) is a b
 
 Google, in a slightly bizarre twist, locks users to only being able to download apps from the Play Store if they enable [Advanced Protection](https://support.google.com/accounts/answer/9764949?hl=en), so if you want the highest security on a stock Android device, you will have to sacrifice sideloading.
 
+As I pointed out with the Apple App Store, malicious apps [bypass](https://www.forbes.com/sites/daveywinder/2025/03/18/60-million-malicious-google-play-downloads-as-331-apps-bypass-security/) the Play Store review all the time. The idea that the Play Store review process is a viable defense against malware is misguided and can put users at risk in my opinion. Google needs to enforce security on the OS level as much as possible to avoid malicious apps, not rely on Play Store review.
+
 The Google Play Store sets a strict [SDK level requirement](https://developer.android.com/google/play/requirements/target-sdk), but apps downloaded outside the Google Play Store have much more leniency. Sideloaded apps can target very old SDK levels, which means they won't have the same security restrictions as apps targeting newer SDK's. The closest thing to a guardrail against running apps with older SDKs is a warning notification from the OS about an app targeting an SDK at or below Android 5.1 (!?). For reference, Android 5 came out in 2014.
 
 I think Android could stand to enforce a higher SDK level and simply refuse to run apps that target lower than say a few versions ago. There's no reason to support apps that think they're on Android 5. GrapheneOS, in line with its firm security posture, raises the minimum SDK from AOSP.

From dbd63640ab1eea3d985cef1923e02b0c241b72a6 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 9 Nov 2025 08:21:56 -0600
Subject: [PATCH 67/68] add more app store details

---
 blog/posts/ios-vs-android.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index 56f70004..b723e2d0 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -128,7 +128,7 @@ Android and iOS have very different approaches in terms of downloading and acqui
 
 iOS restricts app downloads to their own App Store. Apple claims this is for security purposes, but it restricts user freedom and makes it possible for Apple to [censor](https://9to5mac.com/2024/09/28/apple-cooperating-with-russia-to-remove-vpn-apps-from-app-store) apps in certain regions.
 
-Apple has a [whitepaper](https://www.apple.com/privacy/docs/Building_a_Trusted_Ecosystem_for_Millions_of_Apps.pdf) explaining why they believe restricting to just the App Store is the best approach to security. Unfortuantely, malicious and fruadulent apps [bypass](https://techcrunch.com/2025/10/09/sora-copycats-flooded-apples-app-store-and-some-still-remain/) Apple's App Store review regularly. Automated and human review can only do so much against an onslaught of malicious apps, so I think that a better approach is to design the system to disallow apps from having access to as much as possible and providing users with highly secure devices to prevent malware as much as possible.
+Apple has a [whitepaper](https://www.apple.com/privacy/docs/Building_a_Trusted_Ecosystem_for_Millions_of_Apps.pdf) explaining why they believe restricting to just the App Store is the best approach to security. Unfortuantely, malicious and fruadulent apps [bypass](https://techcrunch.com/2025/10/09/sora-copycats-flooded-apples-app-store-and-some-still-remain/) Apple's App Store review regularly. Automated and human review can only do so much against an onslaught of malicious apps, so I think that a better approach is to design the system to disallow apps from having access to as much as possible and providing users with highly secure devices to prevent malware as much as possible. In the same whitepaper, Apple outlines some things they've done to combat malicious apps in a more systemic way such as SDK package signing. In contrast to their claims, the EU's DMA seems to have spurred them to improve security on iOS in several ways while also increasing user freedom.
 
 The App Store does enforce certain [security](https://support.apple.com/guide/security/about-app-store-security-secb8f887a15/1/web/1) properties, mainly through the App Review process. This process can't catch everything though, and [malware](https://securelist.com/sparkcat-stealer-in-app-store-and-google-play/115385) still slips through the cracks.
 

From e9a7b9dbbdc63457c0ab45cf93607922753bece0 Mon Sep 17 00:00:00 2001
From: fria <138676274+friadev@users.noreply.github.com>
Date: Sun, 9 Nov 2025 09:00:22 -0600
Subject: [PATCH 68/68] add optional app hardening

---
 blog/posts/ios-vs-android.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/blog/posts/ios-vs-android.md b/blog/posts/ios-vs-android.md
index b723e2d0..e472b157 100644
--- a/blog/posts/ios-vs-android.md
+++ b/blog/posts/ios-vs-android.md
@@ -308,3 +308,7 @@ I hope Google will see app fingerprinting as a real problem and take steps to mi
 
 ## Optional App Hardening
 
+While enforcing strong security is great, it's not always possible to force all apps to adhere to the best security practices. That's why providing developers optional security features they can enable is so beneficial; developers can get their apps ready for them before they become the default. For example, MTE is a new hardware security feature recently enabled in the stock OS on Google Pixels and on iPhones. If Apple and Google made it on by default, a lot of apps would constantly crash and it would ruin the user experience. Giving devs an opportunity to test it out and enable it optionally first allows them to get their app ready so they can seemlessly transition to the new default security after a while.
+
+### iOS
+